Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
MOUSE DRIVER V628M Setup.exe

Overview

General Information

Sample name:MOUSE DRIVER V628M Setup.exe
Analysis ID:1559384
MD5:5e4878a6c4aa83627e213da27011d658
SHA1:4cd633b7247089b345dc6eef1fd0907ab58df3df
SHA256:9368f50ee12f0d78b86dd9bb3bb1a0e0647d90094834b725d318af696e58fa04
Infos:

Detection

Score:24
Range:0 - 100
Whitelisted:false
Confidence:20%

Signatures

Contains functionality to register a low level keyboard hook
Installs a global keyboard hook
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Installs a global mouse hook
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

  • System is w10x64
  • MOUSE DRIVER V628M Setup.exe (PID: 7500 cmdline: "C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe" MD5: 5E4878A6C4AA83627E213DA27011D658)
    • MOUSE DRIVER V628M Setup.tmp (PID: 7516 cmdline: "C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp" /SL5="$10472,1195863,572928,C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe" MD5: 6CA87850DD6B5C077CAC15F6D33189D7)
      • Monitor.exe (PID: 7704 cmdline: "C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe" 1 MD5: C0C6BDC385DEB10654C7558831EEFA03)
        • Option.exe (PID: 7856 cmdline: "C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe" MD5: 705A431F29F577E556CE3E22DDDC737C)
  • cleanup
No configs have been found
No yara matches
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp, ProcessId: 7516, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MOSUE DRIVER V628M
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results
Source: MOUSE DRIVER V628M Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: MOUSE DRIVER V628M Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00415E95 __EH_prolog,GetFullPathNameW,lstrcpynW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrcpyW,3_2_00415E95
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0044FB40 __EH_prolog,GetFullPathNameW,lstrcpynW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrcpyW,5_2_0044FB40
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1864456932.0000000002CC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Option.exeString found in binary or memory: http://www.aulacn.com
Source: MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1781521750.0000000005F91000.00000004.00001000.00020000.00000000.sdmp, Option.exe, 00000005.00000000.1851495810.0000000000471000.00000008.00000001.01000000.0000000C.sdmp, Option.exe, 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmp, is-NNK05.tmp.1.drString found in binary or memory: http://www.aulacn.com4443523938BUTTONPOS37skins
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1880563812.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1880424331.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
Source: Option.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876034099.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876408007.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876206837.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
Source: Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersH
Source: Option.exe, 00000005.00000003.1880424331.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coma
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
Source: MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684397001.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684765864.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000000.1686144736.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-0HRNP.tmp.1.dr, MOUSE DRIVER V628M Setup.tmp.0.drString found in binary or memory: http://www.innosetup.com/
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1867610888.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: Option.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/TF
Source: Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/TTF
Source: Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0Q
Source: Option.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876577748.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876034099.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876408007.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876206837.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/=
Source: Option.exe, 00000005.00000003.1867610888.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/o
Source: Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/oi
Source: Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ueZ
Source: Option.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876034099.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876408007.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876206837.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/v
Source: Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1867610888.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/~
Source: MOUSE DRIVER V628M Setup.exeString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1795241112.0000000000A1B000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1784041085.00000000023AC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.kngstr.com/?PreDefines.ish
Source: MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1795241112.0000000000A1B000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1683776043.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1784041085.00000000023B4000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1783757069.000000000330F000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1687382112.0000000003210000.00000004.00001000.00020000.00000000.sdmp, is-0HRNP.tmp.1.drString found in binary or memory: http://www.kngstr.com/?PreDefines.ishAbout
Source: Option.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876577748.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876034099.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876408007.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876206837.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.monotype.c
Source: MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684397001.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684765864.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000000.1686144736.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-0HRNP.tmp.1.dr, MOUSE DRIVER V628M Setup.tmp.0.drString found in binary or memory: http://www.remobjects.com/ps
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1857048296.0000000002CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
Source: Option.exe, 00000005.00000003.1868114199.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1867610888.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.co
Source: Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing

barindex
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_004016C0 SetWindowsHookExW 0000000D,Function_00001650,?,000000003_2_004016C0
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeWindows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeWindows user hook set: 0 mouse low level C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\KBHook.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeWindows user hook set: 7860 call wnd proc C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeWindows user hook set: 0 mouse low level C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\KBHook.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00415867 GetKeyState,GetKeyState,GetKeyState,GetKeyState,3_2_00415867
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00413F36 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,3_2_00413F36
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0044CE5B GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,5_2_0044CE5B
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0044F07D GetKeyState,GetKeyState,GetKeyState,GetKeyState,5_2_0044F07D
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_0040E13C3_2_0040E13C
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_004132C43_2_004132C4
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00406B103_2_00406B10
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00403EE03_2_00403EE0
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0044C0DC5_2_0044C0DC
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_004484F05_2_004484F0
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0043F6F95_2_0043F6F9
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_004238505_2_00423850
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0044386D5_2_0044386D
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: String function: 0040A1B8 appears 52 times
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: String function: 0041500C appears 188 times
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: String function: 0044E5BA appears 233 times
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: String function: 00439E18 appears 140 times
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: String function: 0044B268 appears 33 times
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: String function: 0044E565 appears 240 times
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: String function: 0044E6AF appears 62 times
Source: MOUSE DRIVER V628M Setup.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: MOUSE DRIVER V628M Setup.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-0HRNP.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-0HRNP.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684765864.000000007FE41000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs MOUSE DRIVER V628M Setup.exe
Source: MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684397001.0000000002545000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs MOUSE DRIVER V628M Setup.exe
Source: MOUSE DRIVER V628M Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engineClassification label: sus24.spyw.winEXE@7/104@0/0
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00404D10 CoInitialize,#17,CoCreateInstance,3_2_00404D10
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0044A9E5 __EH_prolog,FindResourceW,LoadResource,LockResource,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow,5_2_0044A9E5
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeMutant created: \Sessions\1\BaseNamedObjects\SI-998_HidHost_Mutex
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeMutant created: \Sessions\1\BaseNamedObjects\SI-998-ShareData-Mutex-Object
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeMutant created: \Sessions\1\BaseNamedObjects\SI-998_Gaming_Mouse_Normal_configure
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeFile created: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmpJump to behavior
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: MOUSE DRIVER V628M Setup.exeString found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeFile read: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe "C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe"
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp "C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp" /SL5="$10472,1195863,572928,C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe "C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe" 1
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe "C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe"
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp "C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp" /SL5="$10472,1195863,572928,C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe "C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe" 1Jump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe "C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe" Jump to behavior
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: oledlg.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: olepro32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: asycfilt.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
Source: MOUSE DRIVER V628M.lnk.1.drLNK file: ..\..\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
Source: MOUSE DRIVER V628M.lnk0.1.drLNK file: ..\..\..\..\..\..\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
Source: Uinstall.lnk.1.drLNK file: ..\..\..\..\..\..\Users\user\AppData\Roaming\MOUSE DRIVER V628M\unins000.exe
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeFile written: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Config.iniJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpWindow found: window name: TMainFormJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpAutomated click: Install
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeWindow detected: Number of UI elements: 43
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeKey value created or modified: HKEY_CURRENT_USER\Control Panel\Mouse MouseSpeedJump to behavior
Source: MOUSE DRIVER V628M Setup.exeStatic file information: File size 1636941 > 1048576
Source: MOUSE DRIVER V628M Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00403350 GetModuleFileNameW,LoadLibraryW,LoadLibraryW,GetProcAddress,Sleep,LoadLibraryW,GetVersionExW,CreateMutexW,GetLastError,CreateThread,SetWindowLongW,FindWindowW,PostMessageW,PostMessageW,PostMessageW,3_2_00403350
Source: is-0HRNP.tmp.1.drStatic PE information: real checksum: 0x0 should be: 0x19e60c
Source: MOUSE DRIVER V628M Setup.exeStatic PE information: real checksum: 0x2aae7 should be: 0x19043a
Source: is-RFBE3.tmp.1.drStatic PE information: real checksum: 0x0 should be: 0xa0d83
Source: is-L6EBJ.tmp.1.drStatic PE information: real checksum: 0x0 should be: 0x1018d
Source: is-02EQK.tmp.1.drStatic PE information: real checksum: 0x0 should be: 0x1019a
Source: MOUSE DRIVER V628M Setup.tmp.0.drStatic PE information: real checksum: 0x0 should be: 0x195c6f
Source: is-NNK05.tmp.1.drStatic PE information: real checksum: 0x0 should be: 0x103de9
Source: is-L6EBJ.tmp.1.drStatic PE information: section name: .HOOKDAT
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_0040A1B8 push eax; ret 3_2_0040A1D6
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00409C70 push eax; ret 3_2_00409C9E
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_021B5510 push eax; ret 3_2_021B553E
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_10002F70 push eax; ret 3_2_10002F9E
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_00439C30 push eax; ret 5_2_00439C5E
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_00439E18 push eax; ret 5_2_00439E36
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-0HRNP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-RFBE3.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-L6EBJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\KBHook.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-NNK05.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-L9A6D.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-02EQK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\lan.dll (copy)Jump to dropped file
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeFile created: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MOUSE DRIVER V628MJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MOUSE DRIVER V628M\MOUSE DRIVER V628M.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MOUSE DRIVER V628M\Uinstall.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run MOSUE DRIVER V628MJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run MOSUE DRIVER V628MJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_004050B0 FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,SetActiveWindow,GetModuleFileNameW,ShellExecuteW,3_2_004050B0
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00404F20 GetLastActivePopup,SetForegroundWindow,CreatePopupMenu,LoadStringW,LoadStringW,AppendMenuW,AppendMenuW,SetMenuDefaultItem,AppendMenuW,LoadStringW,AppendMenuW,GetCursorPos,TrackPopupMenu,PostMessageW,DestroyMenu,GetLastActivePopup,IsIconic,SetForegroundWindow,SetActiveWindow,PostMessageW,3_2_00404F20
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00408F9E IsIconic,GetWindowPlacement,GetWindowRect,3_2_00408F9E
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_00409EC0 IsIconic,SendMessageW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,GetClientRect,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleBitmap,BitBlt,GdipCreateStringFormat,GdipCreateFontFamilyFromName,GdipCreateFont,GdipCreateFromHDC,GdipCreateSolidFill,LoadStringW,LoadStringW,GdipSetStringFormatAlign,GdipSetStringFormatLineAlign,GdipSetStringFormatFlags,GdipSetStringFormatTrimming,GdipSetTextRenderingHint,GdipDrawString,LoadStringW,GdipDrawString,LoadStringW,GdipSetStringFormatAlign,GdipDrawString,LoadStringW,GdipSetStringFormatAlign,GdipDrawString,LoadStringW,GdipDrawString,LoadStringW,GdipDrawString,LoadStringW,GdipSetStringFormatAlign,GdipDrawString,LoadStringW,GdipSetStringFormatAlign,GdipDrawString,BitBlt,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDeleteBrush,GdipDeleteGraphics,GdipDeleteFont,GdipDeleteFontFamily,GdipDeleteStringFormat,5_2_00409EC0
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_00446450 GetPropA,CallWindowProcA,CallWindowProcA,IsIconic,CallWindowProcA,GetWindowLongA,SendMessageA,CallWindowProcA,CallWindowProcA,GetWindowLongA,GetClassNameA,lstrcmpA,CallWindowProcA,GetWindowLongA,CallWindowProcA,CallWindowProcA,CallWindowProcA,5_2_00446450
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_00431941 MonitorFromWindow,IsIconic,GetWindowPlacement,GetWindowRect,5_2_00431941
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_00445CA0 CallWindowProcA,DefWindowProcA,IsIconic,SendMessageA,GetWindowLongA,GetWindowLongA,GetWindowDC,GetWindowRect,InflateRect,InflateRect,SelectObject,OffsetRect,SelectObject,ReleaseDC,5_2_00445CA0
Source: C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-0HRNP.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-L6EBJ.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\KBHook.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-L9A6D.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-02EQK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\lan.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeAPI coverage: 9.6 %
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeAPI coverage: 7.0 %
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809Jump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00415E95 __EH_prolog,GetFullPathNameW,lstrcpynW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrcpyW,3_2_00415E95
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0044FB40 __EH_prolog,GetFullPathNameW,lstrcpynW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrcpyW,5_2_0044FB40
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeAPI call chain: ExitProcess graph end nodegraph_3-19254
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeAPI call chain: ExitProcess graph end nodegraph_3-16888
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00403350 GetModuleFileNameW,LoadLibraryW,LoadLibraryW,GetProcAddress,Sleep,LoadLibraryW,GetVersionExW,CreateMutexW,GetLastError,CreateThread,SetWindowLongW,FindWindowW,PostMessageW,PostMessageW,PostMessageW,3_2_00403350
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_0040D8CC SetUnhandledExceptionFilter,3_2_0040D8CC
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_0040D8BA SetUnhandledExceptionFilter,3_2_0040D8BA
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0043E27A SetUnhandledExceptionFilter,5_2_0043E27A
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeCode function: 5_2_0043E28C SetUnhandledExceptionFilter,5_2_0043E28C
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00403850 keybd_event,keybd_event,Sleep,keybd_event,3_2_00403850
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00406090 mouse_event,3_2_00406090
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeProcess created: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe "C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00404DA0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateFileMappingW,MapViewOfFile,LocalFree,LocalFree,3_2_00404DA0
Source: MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1781521750.0000000006096000.00000004.00001000.00020000.00000000.sdmp, Monitor.exe, 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmp, Monitor.exe, 00000003.00000000.1780336287.0000000000421000.00000008.00000001.01000000.00000007.sdmpBinary or memory string: openSysTabControl32Shell_TrayWndclick up
Source: Monitor.exeBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_0040ED33 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,3_2_0040ED33
Source: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exeCode function: 3_2_00403350 GetModuleFileNameW,LoadLibraryW,LoadLibraryW,GetProcAddress,Sleep,LoadLibraryW,GetVersionExW,CreateMutexW,GetLastError,CreateThread,SetWindowLongW,FindWindowW,PostMessageW,PostMessageW,PostMessageW,3_2_00403350
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter
11
Registry Run Keys / Startup Folder
12
Process Injection
1
Masquerading
221
Input Capture
1
System Time Discovery
Remote Services221
Input Capture
1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Native API
1
DLL Side-Loading
11
Registry Run Keys / Startup Folder
12
Process Injection
LSASS Memory2
Process Discovery
Remote Desktop Protocol1
Archive Collected Data
Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading
1
Deobfuscate/Decode Files or Information
Security Account Manager1
Application Window Discovery
SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
Obfuscated Files or Information
NTDS2
System Owner/User Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading
LSA Secrets3
File and Directory Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials22
System Information Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1559384 Sample: MOUSE DRIVER V628M Setup.exe Startdate: 20/11/2024 Architecture: WINDOWS Score: 24 32 Contains functionality to register a low level keyboard hook 2->32 8 MOUSE DRIVER V628M Setup.exe 2 2->8         started        process3 file4 20 C:\Users\...\MOUSE DRIVER V628M Setup.tmp, PE32 8->20 dropped 11 MOUSE DRIVER V628M Setup.tmp 27 64 8->11         started        process5 file6 22 C:\Users\user\AppData\...\Option.exe (copy), PE32 11->22 dropped 24 C:\Users\user\AppData\...\Monitor.exe (copy), PE32 11->24 dropped 26 C:\Users\user\AppData\...\unins000.exe (copy), PE32 11->26 dropped 28 8 other files (none is malicious) 11->28 dropped 14 Monitor.exe 1 1 11->14         started        process7 signatures8 34 Installs a global keyboard hook 14->34 17 Option.exe 2 14->17         started        process9 signatures10 30 Installs a global keyboard hook 17->30

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
MOUSE DRIVER V628M Setup.exe5%ReversingLabs
SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp5%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-L9A6D.tmp\_isetup\_setup64.tmp0%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\KBHook.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-02EQK.tmp0%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-0HRNP.tmp5%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-L6EBJ.tmp0%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-NNK05.tmp0%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\is-RFBE3.tmp0%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\lan.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\unins000.exe (copy)5%ReversingLabs
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
http://www.fontbureau.com/designersH0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/~0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/oi0%Avira URL Cloudsafe
http://www.monotype.c0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/jp/=0%Avira URL Cloudsafe
http://www.aulacn.com0%Avira URL Cloudsafe
http://www.zhongyicts.co0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/Y0Q0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/v0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/=0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/TTF0%Avira URL Cloudsafe
http://www.aulacn.com4443523938BUTTONPOS37skins0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/o0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/TF0%Avira URL Cloudsafe
http://www.jiyu-kobo.co.jp/ueZ0%Avira URL Cloudsafe
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://www.innosetup.com/MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684397001.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684765864.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000000.1686144736.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-0HRNP.tmp.1.dr, MOUSE DRIVER V628M Setup.tmp.0.drfalse
    high
    http://www.fontbureau.com/designersHOption.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    unknown
    http://www.apache.org/licenses/LICENSE-2.0Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1864456932.0000000002CC7000.00000004.00000020.00020000.00000000.sdmpfalse
      high
      http://www.fontbureau.comOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1880563812.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1880424331.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpfalse
        high
        http://www.fontbureau.com/designersGOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
          high
          http://www.fontbureau.com/designers/?Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
            high
            http://www.founder.com.cn/cn/bTheOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
              high
              http://www.fontbureau.com/designers?Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                high
                http://www.jiyu-kobo.co.jp/Y0QOption.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                unknown
                http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUMOUSE DRIVER V628M Setup.exefalse
                  high
                  http://www.tiro.comOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                    high
                    http://www.aulacn.comOption.exefalse
                    • Avira URL Cloud: safe
                    unknown
                    http://www.monotype.cOption.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876577748.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876034099.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876408007.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876206837.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    unknown
                    http://www.fontbureau.com/designersOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpfalse
                      high
                      http://www.kngstr.com/?PreDefines.ishAboutMOUSE DRIVER V628M Setup.exe, 00000000.00000003.1795241112.0000000000A1B000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1683776043.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1784041085.00000000023B4000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1783757069.000000000330F000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1687382112.0000000003210000.00000004.00001000.00020000.00000000.sdmp, is-0HRNP.tmp.1.drfalse
                        high
                        http://www.goodfont.co.krOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                          high
                          http://www.jiyu-kobo.co.jp/oiOption.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          unknown
                          http://www.jiyu-kobo.co.jp/jp/Option.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876577748.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876034099.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876408007.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876206837.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpfalse
                            high
                            http://www.fontbureau.comaOption.exe, 00000005.00000003.1880424331.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpfalse
                              high
                              http://www.jiyu-kobo.co.jp/=Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              http://www.jiyu-kobo.co.jp/~Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1867610888.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              http://www.carterandcone.comlOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                high
                                http://www.jiyu-kobo.co.jp/jp/=Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                unknown
                                http://www.sajatypeworks.comOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1857048296.0000000002CCB000.00000004.00000020.00020000.00000000.sdmpfalse
                                  high
                                  http://www.typography.netDOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    high
                                    http://www.fontbureau.com/designers/cabarga.htmlNOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      high
                                      http://www.founder.com.cn/cn/cTheOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        high
                                        http://www.zhongyicts.coOption.exe, 00000005.00000003.1868114199.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1867610888.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://www.galapagosdesign.com/staff/dennis.htmOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                          high
                                          http://www.founder.com.cn/cnOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                            high
                                            http://www.kngstr.com/?PreDefines.ishMOUSE DRIVER V628M Setup.exe, 00000000.00000003.1795241112.0000000000A1B000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1784041085.00000000023AC000.00000004.00001000.00020000.00000000.sdmpfalse
                                              high
                                              http://www.fontbureau.com/designers/frere-user.htmlOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                high
                                                http://www.jiyu-kobo.co.jp/vOption.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876034099.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876408007.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876206837.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://www.aulacn.com4443523938BUTTONPOS37skinsMOUSE DRIVER V628M Setup.tmp, 00000001.00000003.1781521750.0000000005F91000.00000004.00001000.00020000.00000000.sdmp, Option.exe, 00000005.00000000.1851495810.0000000000471000.00000008.00000001.01000000.0000000C.sdmp, Option.exe, 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmp, is-NNK05.tmp.1.drfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://www.jiyu-kobo.co.jp/oOption.exe, 00000005.00000003.1867610888.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://www.jiyu-kobo.co.jp/Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1867610888.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  high
                                                  http://www.fontbureau.com/Option.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876034099.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876408007.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1876206837.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    high
                                                    http://www.jiyu-kobo.co.jp/TFOption.exe, 00000005.00000003.1875867070.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1870913186.0000000002CB8000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874445182.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1873344256.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872942152.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1872730217.0000000002CBB000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874819663.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1874638953.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875303801.0000000002CBC000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1875577501.0000000002CBC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    http://www.galapagosdesign.com/DPleaseOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      high
                                                      http://www.fontbureau.com/designers8Option.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        high
                                                        http://www.fonts.comOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          high
                                                          http://www.sandoll.co.krOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            high
                                                            http://www.remobjects.com/psMOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684397001.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.exe, 00000000.00000003.1684765864.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, MOUSE DRIVER V628M Setup.tmp, 00000001.00000000.1686144736.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-0HRNP.tmp.1.dr, MOUSE DRIVER V628M Setup.tmp.0.drfalse
                                                              high
                                                              http://www.urwpp.deDPleaseOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                high
                                                                http://www.zhongyicts.com.cnOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  high
                                                                  http://www.jiyu-kobo.co.jp/ueZOption.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  unknown
                                                                  http://www.sakkal.comOption.exe, 00000005.00000002.2953075763.00000000046F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    high
                                                                    http://www.jiyu-kobo.co.jp/TTFOption.exe, 00000005.00000003.1869062579.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp, Option.exe, 00000005.00000003.1868572841.0000000002CB4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    No contacted IP infos
                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                    Analysis ID:1559384
                                                                    Start date and time:2024-11-20 13:19:02 +01:00
                                                                    Joe Sandbox product:CloudBasic
                                                                    Overall analysis duration:0h 6m 27s
                                                                    Hypervisor based Inspection enabled:false
                                                                    Report type:full
                                                                    Cookbook file name:default.jbs
                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                    Number of analysed new started processes analysed:11
                                                                    Number of new started drivers analysed:0
                                                                    Number of existing processes analysed:0
                                                                    Number of existing drivers analysed:0
                                                                    Number of injected processes analysed:0
                                                                    Technologies:
                                                                    • HCA enabled
                                                                    • EGA enabled
                                                                    • AMSI enabled
                                                                    Analysis Mode:default
                                                                    Analysis stop reason:Timeout
                                                                    Sample name:MOUSE DRIVER V628M Setup.exe
                                                                    Detection:SUS
                                                                    Classification:sus24.spyw.winEXE@7/104@0/0
                                                                    EGA Information:
                                                                    • Successful, ratio: 100%
                                                                    HCA Information:
                                                                    • Successful, ratio: 100%
                                                                    • Number of executed functions: 109
                                                                    • Number of non-executed functions: 332
                                                                    Cookbook Comments:
                                                                    • Found application associated with file extension: .exe
                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                    • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                    • VT rate limit hit for: MOUSE DRIVER V628M Setup.exe
                                                                    TimeTypeDescription
                                                                    12:20:05AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run MOSUE DRIVER V628M C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
                                                                    No context
                                                                    No context
                                                                    No context
                                                                    No context
                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                    C:\Users\user\AppData\Local\Temp\is-L9A6D.tmp\_isetup\_setup64.tmpAI_ChainedPackageFile.VistaSoftware.exeGet hashmaliciousPureCrypterBrowse
                                                                      AaronGiles(1).exeGet hashmaliciousPureCrypterBrowse
                                                                        740d3a.msiGet hashmaliciousUnknownBrowse
                                                                          AI_ChainedPackageFile.VistaSoftware.exeGet hashmaliciousPureCrypterBrowse
                                                                            Reminder.exeGet hashmaliciousPureCrypterBrowse
                                                                              KEFttAEb.vbsGet hashmaliciousPureCrypterBrowse
                                                                                AaronGiles(1).exeGet hashmaliciousPureCrypterBrowse
                                                                                  740d3a.msiGet hashmaliciousPureCrypterBrowse
                                                                                    Reminder.exeGet hashmaliciousPureCrypterBrowse
                                                                                      reservation .exeGet hashmaliciousTVratBrowse
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Nov 20 11:20:00 2024, mtime=Wed Nov 20 11:20:01 2024, atime=Tue Aug 21 22:16:44 2018, length=614400, window=hide
                                                                                        Category:dropped
                                                                                        Size (bytes):2011
                                                                                        Entropy (8bit):3.498141624030743
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:80Um2L+gzm/6KlijGl1UAyL4rB9rMg/jCy6RrBBkWUmBV/Bm:8032hzm/69GjRV9rrrCySVBkWNBD
                                                                                        MD5:D5347703098CAF819BB214D090548FF3
                                                                                        SHA1:9F7DCAE935BE9E8D66978753EA3396AAB637E3C0
                                                                                        SHA-256:D721C03720C1D2D5164C1394A5F045EBCC40FE62D493781537D0484E6D26A792
                                                                                        SHA-512:40C1426F83B53D5017C77D93798631FAE49C7422DC3D67416C3A7FAD400BDC1A69E655F5F69B639BC47401D50CD9511726F35942DA1B5E7B0F4386433E5B63AD
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:L..................F.@.. ....gQ.F;..j)..F;....a..9...`........................:..DG..Yr?.D..U..k0.&...&......vk.v.......}F;...=..F;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tYzb...........................%..A.p.p.D.a.t.a...B.V.1.....tY.b..Roaming.@......CW.^tY.b..........................ty..R.o.a.m.i.n.g.....n.1.....tY.b..MOUSED~1..V......tY.btY.b..........................R...M.O.U.S.E. .D.R.I.V.E.R. .V.6.2.8.M.....b.2..`...M.. .Monitor.exe.H......tY.btY.b.....4........................M.o.n.i.t.o.r...e.x.e.......l...............-.......k............G(.....C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe..L.....\.....\.....\.....\.....\.....\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.O.U.S.E. .D.R.I.V.E.R. .V.6.2.8.M.\.M.o.n.i.t.o.r...e.x.e.4.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s... .1.:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Nov 20 11:20:00 2024, mtime=Wed Nov 20 11:20:00 2024, atime=Wed Nov 20 11:19:54 2024, length=1654643, window=hide
                                                                                        Category:dropped
                                                                                        Size (bytes):2022
                                                                                        Entropy (8bit):3.5711894588961
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:832hzm/6904cYjvaVgZrCyAVMhMWaMhr:8GUa04chg1CtMhzaMh
                                                                                        MD5:94503C755CC17CB68F48141C21F82A01
                                                                                        SHA1:33195887B5D47B1A09533B2E28994EE4A7A33BBF
                                                                                        SHA-256:2C16219D5FB82D491507854C4898115F087AB6760880BDC3EA991295971B4D2E
                                                                                        SHA-512:A42FD3E6D8C29AC8401B998FFB02D3EDE5518F9C582592F86D458F274DC4C432DEC7B894298B6469DDD238DF53E0D6D7696D95E8613F900C57CC93CFAE519B54
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:L..................F.@.. ....-7.F;...-7.F;..U.}.F;..s?........................:..DG..Yr?.D..U..k0.&...&......vk.v.......}F;...=..F;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tYzb...........................%..A.p.p.D.a.t.a...B.V.1.....tY.b..Roaming.@......CW.^tY.b..........................ty..R.o.a.m.i.n.g.....n.1.....tY.b..MOUSED~1..V......tY.btY.b..........................R...M.O.U.S.E. .D.R.I.V.E.R. .V.6.2.8.M.....f.2.s?..tY|b .unins000.exe..J......tY.btY.b...........................<..u.n.i.n.s.0.0.0...e.x.e.......m...............-.......l............G(.....C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\unins000.exe..M.....\.....\.....\.....\.....\.....\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.O.U.S.E. .D.R.I.V.E.R. .V.6.2.8.M.\.u.n.i.n.s.0.0.0...e.x.e.4.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.?.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Nov 20 11:20:00 2024, mtime=Wed Nov 20 11:20:00 2024, atime=Tue Aug 21 22:16:44 2018, length=614400, window=hide
                                                                                        Category:dropped
                                                                                        Size (bytes):1917
                                                                                        Entropy (8bit):3.479465113026629
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:8Jum2L+A9mm/6KlijGl1UAyLorB9rFrBBkWUmBV/Bm:8T2B9mm/69GjBV9rFVBkWNBD
                                                                                        MD5:8F507FF5EA9BFC4A90EF894C7FC02F35
                                                                                        SHA1:256D7A5894ECC9D2C569AC07CEBF748B6427F935
                                                                                        SHA-256:178CCDAFB1312CE724286E58E6E4459F5A5ACC83F2E977561931EDD684F2E70D
                                                                                        SHA-512:F5ECE438A660B9D0404A4292A1E52560A87AFAC629C7C38B8E04F5981F27C060D2AE7ADC5633B5B9E1F8560DFBD3ADD975E59001E37CC2C92F0A773B13EB52F0
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:L..................F.@.. ....gQ.F;....S.F;....a..9...`........................:..DG..Yr?.D..U..k0.&...&......vk.v.......}F;...=..F;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tYzb...........................%..A.p.p.D.a.t.a...B.V.1.....tYxb..Roaming.@......CW.^tYxb..........................y2*.R.o.a.m.i.n.g.....n.1.....tY.b..MOUSED~1..V......tY.btY.b..........................R...M.O.U.S.E. .D.R.I.V.E.R. .V.6.2.8.M.....b.2..`...M.. .Monitor.exe.H......tY.btY.b.....4........................M.o.n.i.t.o.r...e.x.e.......l...............-.......k............G(.....C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe..:.....\.....\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.O.U.S.E. .D.R.I.V.E.R. .V.6.2.8.M.\.M.o.n.i.t.o.r...e.x.e...C.:.\.U.s.e.r.s.\.P.u.b.l.i.c.\.D.e.s.k.t.o.p... .1.:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.O.U.S.E. .D.R.I.V.E.R. .V.6.2.8.M.\.I.c.o.n...i.c.o.........%APPDATA%\MOUSE DRIVER V628M\Ico
                                                                                        Process:C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1631744
                                                                                        Entropy (8bit):5.77837817967913
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:1tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5DqixYVTx9V/:7qTytRFk6ek1DGn
                                                                                        MD5:6CA87850DD6B5C077CAC15F6D33189D7
                                                                                        SHA1:2C2A3DFCCC7C494619BCB5E525F256CC693C3AB0
                                                                                        SHA-256:4EDC89CC40FB17B992DDADBE594894E6083CB36E7BF322EFF266FEA0688511A4
                                                                                        SHA-512:90E55D6AFDA7F06C50D35A38C33237613D67A61BA73DDC204DC3BDCB4B3E2B442531D74847591F752522DFA3A3D035565B1E3DABDB677ABA5B9B4FB16DA83C95
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 5%
                                                                                        Reputation:low
                                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0...x................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....x...0...z...l..............@..@....................................@..@........................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):6144
                                                                                        Entropy (8bit):4.720366600008286
                                                                                        Encrypted:false
                                                                                        SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                        MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                        SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                        SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                        SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Joe Sandbox View:
                                                                                        • Filename: AI_ChainedPackageFile.VistaSoftware.exe, Detection: malicious, Browse
                                                                                        • Filename: AaronGiles(1).exe, Detection: malicious, Browse
                                                                                        • Filename: 740d3a.msi, Detection: malicious, Browse
                                                                                        • Filename: AI_ChainedPackageFile.VistaSoftware.exe, Detection: malicious, Browse
                                                                                        • Filename: Reminder.exe, Detection: malicious, Browse
                                                                                        • Filename: KEFttAEb.vbs, Detection: malicious, Browse
                                                                                        • Filename: AaronGiles(1).exe, Detection: malicious, Browse
                                                                                        • Filename: 740d3a.msi, Detection: malicious, Browse
                                                                                        • Filename: Reminder.exe, Detection: malicious, Browse
                                                                                        • Filename: reservation .exe, Detection: malicious, Browse
                                                                                        Reputation:high, very likely benign file
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe
                                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                                        Category:dropped
                                                                                        Size (bytes):1572864
                                                                                        Entropy (8bit):3.867262620208236
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:8BSB48Thh6DTdhjqBEycjjV55555rhFu4G0cnfB+6fV8LS5quH0cvFBDBSB48Thc:ka0DXj3mlcUCLuqyDa0DXAa0DX
                                                                                        MD5:C647977861E5078F5C214AED8904224D
                                                                                        SHA1:30A90CBD5BB1899AECF2B8D068BDA45DFF150962
                                                                                        SHA-256:1185592913DD36857714D36B21B74DD112520B8C0F1D23E9B6B1A30E2B3C399A
                                                                                        SHA-512:251098E3B00B4EE41B32D647651FF65A3326433D3D165C96E9954150F0BA56375306E32D148D79AA49639F9526E218AC77C4F85E32564432B4C6AB29FEE3F047
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
                                                                                        File Type:Generic INItialization configuration [HidAccessCode]
                                                                                        Category:dropped
                                                                                        Size (bytes):1480
                                                                                        Entropy (8bit):1.0365894951629362
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:eXeRlrL+ykGvOzAXhUGtbGXWWjd1LYkc7LKJDMw//+ddomNZlnUL1/Fhn:e+0iOutbhwDYkcqInY/Fh
                                                                                        MD5:97FEA5BDFB9589734CD7254941800A27
                                                                                        SHA1:A00BCD77C36F77CF54E6239A2634DD7414BC30CC
                                                                                        SHA-256:DD8B2D11E32E67C71AF6639634E1D40D09586FACC7967794388805F9C32E9FC4
                                                                                        SHA-512:E1D33591753C7A6285FDD8E0DBBE83E3228140243A11D076E12CB5179F0ECAC81B1E6B604B9B5E47B9E96133B2CECEFAA3DC5B8939ABF630B05956975492C58E
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:[Setting]..CurrentProfile=0..MouseType=5..Device=1..FWVersion=123..[HidAccessCode]..Code=DC78CC5A0000000000000000000000007A....[OSDSetting]..config=0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006E0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
                                                                                        Process:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.663928790403894
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:ZZgoKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:ZZgXCVmwfr4dLS4dy40
                                                                                        MD5:9B9CD34AEF04527ADBB6486B9B30881B
                                                                                        SHA1:A59A29676B7489C81905586930D090B8B30D9646
                                                                                        SHA-256:385AAB784C948633BBF1B68EC02DFF1E289D5BB48F0D646561E755E2CCA87164
                                                                                        SHA-512:434C3ABE5F97FE0BABCD3A0AC34F0F88F831AFF237F015743F3716E5DF8A7DB729632AD62DA6B99E7B59B59B03E25C33D2559E5ED21052077AB3295343DF431A
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default1..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=1..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.6636379569758399
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Z8gRTKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:Z8gRGCVmwfr4dLS4dy40
                                                                                        MD5:A2CA1BF36BE7DDC11B10DFFE7883C62C
                                                                                        SHA1:1B172F32B9A0F02F4B5A82AF99625ED5A3B62F13
                                                                                        SHA-256:9279D61DC222FB648DF3953C6C747813336EF0738E018B563FA3347AA3B4A293
                                                                                        SHA-512:2D3EAB2AE6CD99933534EAA0D85F38661402394693FD7ECAD82BC1B9E6A99C8DC2985B997A16DF03FF181D8384BE5CCD72C765C29108FBBF5B8D914EA9CEFE38
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default2..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=0..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.6636469478108823
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:ZfgRTKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:ZfgRGCVmwfr4dLS4dy40
                                                                                        MD5:B93BC9E3E4113075D3D94C33B102FBDF
                                                                                        SHA1:D91FCA1F15EA489BDF2EC5B1F2B6790DA7380A0D
                                                                                        SHA-256:7CB77FD22074A02F12D4472F8885BFBD64FA43BC5F86575B8D40E2A2A65FEEEC
                                                                                        SHA-512:FD981820700AA0AB2A4B360061F8055901D392E61CA67351BD54E45A89619E8171826A6F038FDA2592E7348677C1274B60F9316DB8D2BAC217247A3BC45FC6C2
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default3..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=0..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.6636759816706409
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Z6gRTKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:Z6gRGCVmwfr4dLS4dy40
                                                                                        MD5:03B64C401069F835A6B7D7F2D90615A6
                                                                                        SHA1:E0F33415C66ED4BA6B19C036DED0004B7B4149FF
                                                                                        SHA-256:84692AF0316CD9AD7DB7FC75E7983883E97C79FCCD0661A53C591B7B84C6C38A
                                                                                        SHA-512:C5BD811ADA4960C87FCDE66BAD827EEF5C24B7A8606AABD260D7F28B7CE3BD3FF476C7507B574296AFEFD2105A6B7FB584568302F8A8DDBFE5145FDA10874104
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default4..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=0..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:modified
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.6636816721971321
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:ZEegRTKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:ZEegRGCVmwfr4dLS4dy40
                                                                                        MD5:7F3A20F3CEE4F2221D47D6B030F6CF3F
                                                                                        SHA1:1D7842E823DB477DDCB391D726C7C3D4E7F66F25
                                                                                        SHA-256:0A14AEDCBC8AC68E7D4DCF527CEADF530D92853B4AAA86ADA80A91B58107740D
                                                                                        SHA-512:C6B8E6EAF568A58E519CF0D234D8A0BD5C05E23CFDA711F0EBC371476EAB31A9A1839908011702DC7C6AF384680624AFC27FF5C3A938AF9AD3ECFFD36CF92E6E
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default5..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=0..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):20
                                                                                        Entropy (8bit):4.021928094887362
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:UNIgln:YIwn
                                                                                        MD5:B8A8C8070242F90FA9F9AA62AF0C4A9F
                                                                                        SHA1:02D922BDC36D76CEB4D55B0F35C5556347D07F11
                                                                                        SHA-256:2D489C195F87167143B5A802127F49165E09F4ED52F7E7AB2F169538C55A66F9
                                                                                        SHA-512:B0ACFFCD6177BBDCD7EB5FB4B66FD815628BE8A412AA365D94FDA83632F818DF0B24D112A64903A658AB6AF95B1260F980D01D3A4C5D3227C2D7A84EF5370854
                                                                                        Malicious:false
                                                                                        Preview:[Macros]..number=0..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.6636759816706409
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Z6gRTKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:Z6gRGCVmwfr4dLS4dy40
                                                                                        MD5:03B64C401069F835A6B7D7F2D90615A6
                                                                                        SHA1:E0F33415C66ED4BA6B19C036DED0004B7B4149FF
                                                                                        SHA-256:84692AF0316CD9AD7DB7FC75E7983883E97C79FCCD0661A53C591B7B84C6C38A
                                                                                        SHA-512:C5BD811ADA4960C87FCDE66BAD827EEF5C24B7A8606AABD260D7F28B7CE3BD3FF476C7507B574296AFEFD2105A6B7FB584568302F8A8DDBFE5145FDA10874104
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default4..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=0..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.6635834566000033
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:ZZgRTKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:ZZgRGCVmwfr4dLS4dy40
                                                                                        MD5:9E44B874CAC97E70294C561BED40CCE6
                                                                                        SHA1:668120FD6B03A9B2E4AEBE852B2F92EE3C6CF28B
                                                                                        SHA-256:CCADD5A6BCCF7B96E78BD3CBFA8A9BA61540E02D9908F0BF5A6BCA49FFD8EA01
                                                                                        SHA-512:098DE98BABC567BB925083E8C7A419BEBF4C2277D5B99EAEE4EBD8CB3918E3727050BF11D5924917E3462A74A3F06E5E726BBC7F69FE65085A9E7A7FAFAA0A74
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default1..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=0..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.6636816721971321
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:ZEegRTKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:ZEegRGCVmwfr4dLS4dy40
                                                                                        MD5:7F3A20F3CEE4F2221D47D6B030F6CF3F
                                                                                        SHA1:1D7842E823DB477DDCB391D726C7C3D4E7F66F25
                                                                                        SHA-256:0A14AEDCBC8AC68E7D4DCF527CEADF530D92853B4AAA86ADA80A91B58107740D
                                                                                        SHA-512:C6B8E6EAF568A58E519CF0D234D8A0BD5C05E23CFDA711F0EBC371476EAB31A9A1839908011702DC7C6AF384680624AFC27FF5C3A938AF9AD3ECFFD36CF92E6E
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default5..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=0..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.6636379569758399
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Z8gRTKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:Z8gRGCVmwfr4dLS4dy40
                                                                                        MD5:A2CA1BF36BE7DDC11B10DFFE7883C62C
                                                                                        SHA1:1B172F32B9A0F02F4B5A82AF99625ED5A3B62F13
                                                                                        SHA-256:9279D61DC222FB648DF3953C6C747813336EF0738E018B563FA3347AA3B4A293
                                                                                        SHA-512:2D3EAB2AE6CD99933534EAA0D85F38661402394693FD7ECAD82BC1B9E6A99C8DC2985B997A16DF03FF181D8384BE5CCD72C765C29108FBBF5B8D914EA9CEFE38
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default2..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=0..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:ASCII text, with very long lines (1601), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):25395
                                                                                        Entropy (8bit):0.6636469478108823
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:ZfgRTKKXTIAtA+AbAivM5WAGfezYqU/VI7URQfYuP4dJ1S4dZC9jvp40:ZfgRGCVmwfr4dLS4dy40
                                                                                        MD5:B93BC9E3E4113075D3D94C33B102FBDF
                                                                                        SHA1:D91FCA1F15EA489BDF2EC5B1F2B6790DA7380A0D
                                                                                        SHA-256:7CB77FD22074A02F12D4472F8885BFBD64FA43BC5F86575B8D40E2A2A65FEEEC
                                                                                        SHA-512:FD981820700AA0AB2A4B360061F8055901D392E61CA67351BD54E45A89619E8171826A6F038FDA2592E7348677C1274B60F9316DB8D2BAC217247A3BC45FC6C2
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..ProFileName=Default3..GameFile=..DbleClickSpeed=500..ScrollWheelSpeed=3..ScrollWheelFlag=0..MouseSpeed=10..Acceleration=10..AccelerationFlag=0..TiltSpeed=3..MediaOption=0..HDDKeyboard=1..Orientation=0..XYSynchronous=1..Sensitivity_X=10..Sensitivity_Y=10..Cpi_X=3..Cpi_Y=3..XYCpiFlag=1..PollingRate=2..LiftSwitch=0..LiftLevel=0..LightSwitch=0..LightType=0..ColorFlag=1..ColorOptions=0..ColorChangeMode=0..BTOption=0..OTGSpeed=10..dpiStepFlag0=1..dpiStepFlag1=1..dpiStepFlag2=1..dpiStepFlag3=1..dpiStepFlag4=0..dpiStepFlag5=0..dpiStepFlag6=0..dpiStepFlag7=0..dpiStepFlag8=0..dpiStepFlag9=0..dpiIndicator0=19..dpiIndicator1=20..dpiIndicator2=21..dpiIndicator3=16..dpiIndicator4=16..dpiIndicator5=0..dpiIndicator6=0..dpiIndicator7=0..dpiIndicator8=0..dpiIndicator9=0..DpiIndicationType=1..CpiXDefault=3..CpiYDefault=3..BtnConfiguration=4..Color1Type=1..Color2Type=1..LightEffectSwitch1=1..LightEffectSwitch2=1..LightEffectType1=1..LightEffectType2=1..ColorOptions1=0..ColorOptions2=0..ColorCha
                                                                                        Process:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):20
                                                                                        Entropy (8bit):4.021928094887362
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:UNIgln:YIwn
                                                                                        MD5:B8A8C8070242F90FA9F9AA62AF0C4A9F
                                                                                        SHA1:02D922BDC36D76CEB4D55B0F35C5556347D07F11
                                                                                        SHA-256:2D489C195F87167143B5A802127F49165E09F4ED52F7E7AB2F169538C55A66F9
                                                                                        SHA-512:B0ACFFCD6177BBDCD7EB5FB4B66FD815628BE8A412AA365D94FDA83632F818DF0B24D112A64903A658AB6AF95B1260F980D01D3A4C5D3227C2D7A84EF5370854
                                                                                        Malicious:false
                                                                                        Preview:[Macros]..number=0..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:MS Windows icon resource - 9 icons, 256x256, 32 bits/pixel, -128x-128, 32 bits/pixel
                                                                                        Category:dropped
                                                                                        Size (bytes):456414
                                                                                        Entropy (8bit):3.1527616027149077
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:8OncC/f/XR1shuxF0x1ikxFd8kF4yWnl5polemIWPn146PjPAwwCp:8OxXB1soxa1i48Lznzpolewn144o7O
                                                                                        MD5:5E0215028A8440C924A26FC472494087
                                                                                        SHA1:1BFDA575658EB63ABAD517D2AEAEFFFBA0B99A76
                                                                                        SHA-256:59D7A7BB2403B3E772A4F77BDB268722C4F2EFE27D7E7F2A273239ABDF467B8E
                                                                                        SHA-512:2D8D032BF2312B8C013FD68A5DD408F43128B42AF0AF3C5E4828F009997999876F3C516067DC048D20495C2AA3DF5A140A2A66E5E7335E27470842E01F41857D
                                                                                        Malicious:false
                                                                                        Preview:............ .( ............ .(.... ..``.... ......(..PP.... ..g......HH.... ..T..v%..@@.... .(B...y..00.... ..%..&... .... ............... .h...v...(............. ...... ............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):40960
                                                                                        Entropy (8bit):4.778378390442913
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:JUJOGWOdwTxQUnGKrcxKK0H8+j0qyZ1/2lM2t:u+TSUnGKrQX40F+lp
                                                                                        MD5:CDA7A1DACFF53B5A4F2FF1F0C3C4EFD7
                                                                                        SHA1:3E294FF59BB5D1C7CED55E1B06C2577E8187FBC7
                                                                                        SHA-256:807BDB98041139A913785116507738BFE1F70CE5AADA2E9FE19401E51FA3DB4D
                                                                                        SHA-512:6C55F03EE1725E0A0697148F2A0A26A0E3B58CB586591916118C030BBC329879F47487D4B9B40FC1A7603E1C45F9F41D0798BA70073010D5CF896689C0A1383A
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E....l...l...l...s..Il...p...l...l..Hl...d..l...s...l...s...l..Rich.l..................PE..L....x.Z...........!.....P...`...............`......................................................................`k...... f..<....................................................................................`...............................text....J.......P.................. ..`.rdata..U....`.......`..............@..@.data....$...p.......p..............@....HOOKDAT............................@....reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):614400
                                                                                        Entropy (8bit):4.132463943221451
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:ierXLq1CSU/e/Bz3ljl5tFxXvsix44pI+j:97qMj/EtNRFqixNGe
                                                                                        MD5:C0C6BDC385DEB10654C7558831EEFA03
                                                                                        SHA1:97B0ECCE07FFC91FFF9512E517A8483C8B758C97
                                                                                        SHA-256:092C61AEB9E35F97126345DB09D92D0CC552772BAF24B998309648AB4BB760F1
                                                                                        SHA-512:69E3F34E4697E639B4DE29114390872D54103FAE7BD50F15713C2D3365F2F509BD84C5425AE3B76BD0536D7C106437947B0E4A5484989CBF5F6ACF4C05CA771D
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G.........A.........n..L......'..K..L.....'.....w......Rich...........PE..L.....{[..........................................@......................................................................................"..............................................................................h............................text............................... ..`.rdata...W.......`..................@..@.data....q....... ..................@....rsrc....".......0...0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1007616
                                                                                        Entropy (8bit):5.167959511911604
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:bl3yu1t9+PYCwTdlX5s51eboHb7crRjgvqixNGe:bdBr9CwTOjebo77clIqixY
                                                                                        MD5:705A431F29F577E556CE3E22DDDC737C
                                                                                        SHA1:9509FDD15FED332A18F61A3D4EED4074806D8A3D
                                                                                        SHA-256:6C29A97A5FB8348A9E379EB8F68E81D5826B50FDDC63FCE306FCB5D3FC118073
                                                                                        SHA-512:5A7C15E0AC3DFEF9A95CA76336380F70D27F2B7691BE935769E3C737D6634C63990A07297B68F709207748D15EC92CBCED894F21A9BB06F99B6A4FA1C70ED3A0
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*7..nV..nV..nV..nV..oV...^..fV...I...V...J..vV...^..qV..nV..WT...I...V...P..oV..RichnV..........PE..L...{.{[..........................................@.............................................................................@.......0............................................................................................................text...?........................... ..`.rdata...........0..................@..@.data...........@..................@....rsrc...0............P..............@..@................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:MS Windows icon resource - 1 icon, 32x32, 32 colors
                                                                                        Category:dropped
                                                                                        Size (bytes):2238
                                                                                        Entropy (8bit):5.989199520116326
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:OfnzL3KfDvDMGdJ3rBsiq4u07PYaDdFxMpE/IKdT3NLSr4UG7tdAJFH6d7Asl6fU:wP3K3V3rSiTL7PYaDxMAhdxeUUAADSHL
                                                                                        MD5:D3DF69130F4B2A59ADBC8B1570542BF2
                                                                                        SHA1:090245FF6B534D2ED42F1B8C37EC3529D7504CDB
                                                                                        SHA-256:8AE43E8E53519DF97254AB33FD0DFD7D7DD526D08D01221F81A84B52D574D454
                                                                                        SHA-512:7EC19DCEAAFE6B7CCC3FB1218A8329F659F7CA1D1C6D2D6DBAEDCCC5475696FC37E32C1ED7E9043679975FA6222A427A65F6A916F3C181CBB5F17FBCCFE9E3DB
                                                                                        Malicious:false
                                                                                        Preview:...... .............(... ...@...............................................................................................................................................................................................................................................................................................................................................c..k..s..v..|...................................................................................................................................................................................................................................................................................................................|.........................ddb.cca.....}}{.........ppo.......................................................~............).).@.@.P.P.`.`.p.p.................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):57344
                                                                                        Entropy (8bit):4.447820886910707
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:42TVmkf7ex2rytDXS41z2nFvl23nigJyS3xmzMdxr:42TVmkCtDXSWChlGnigw6SMdd
                                                                                        MD5:4B1802D3E3C02CFF30186327F6CDD166
                                                                                        SHA1:2454A1D0E96E897C67D63632DF881E91FC463239
                                                                                        SHA-256:4D09D1DAA11C73EF4992BC3B157C4EA4E2D2940C83AF8616468447A3D4D83DCA
                                                                                        SHA-512:F1BE8C349D043F790878B34E719BC25A660EE756ECBCF8B8F8AFC867015D4BBFCB0263052B1EF8E715BDABFF62C0DF12A9A91F01B9B8BD9FDB80D7ABA2890408
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t..................2....................2......6.....v......Rich............PE..L......O...........!.....@...................P...............................................................................V..(.......l8...........................................................................P...............................text...Z?.......@.................. ..`.rdata.......P.......P..............@..@.data... 1...`...0...`..............@....rsrc...l8.......@..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1654643
                                                                                        Entropy (8bit):5.765146909055034
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:9tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5DqixYVTx9VD:zqTytRFk6ek1DGL
                                                                                        MD5:052729768EF5BE0F98FA7A8E39880B49
                                                                                        SHA1:1912862FD845FD7E01B8005B7D968E1318F6B16B
                                                                                        SHA-256:5F873CEE08F0EEF35B8B83F04E0C80058105C2EAD121365E439AF305A61CC2CF
                                                                                        SHA-512:511BBBDB962ABD052A8A27BB35B32E71A3D0F63E5183888FE6E481CD785C3538B6B24EE5303403BB5B3E5B554919B9A4ACF43C6D68559EAB65C0FCCE630508D9
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 5%
                                                                                        Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0...x................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....x...0...z...l..............@..@....................................@..@........................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:MS Windows icon resource - 1 icon, 32x32, 32 colors
                                                                                        Category:dropped
                                                                                        Size (bytes):2238
                                                                                        Entropy (8bit):5.989199520116326
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:OfnzL3KfDvDMGdJ3rBsiq4u07PYaDdFxMpE/IKdT3NLSr4UG7tdAJFH6d7Asl6fU:wP3K3V3rSiTL7PYaDxMAhdxeUUAADSHL
                                                                                        MD5:D3DF69130F4B2A59ADBC8B1570542BF2
                                                                                        SHA1:090245FF6B534D2ED42F1B8C37EC3529D7504CDB
                                                                                        SHA-256:8AE43E8E53519DF97254AB33FD0DFD7D7DD526D08D01221F81A84B52D574D454
                                                                                        SHA-512:7EC19DCEAAFE6B7CCC3FB1218A8329F659F7CA1D1C6D2D6DBAEDCCC5475696FC37E32C1ED7E9043679975FA6222A427A65F6A916F3C181CBB5F17FBCCFE9E3DB
                                                                                        Malicious:false
                                                                                        Preview:...... .............(... ...@...............................................................................................................................................................................................................................................................................................................................................c..k..s..v..|...................................................................................................................................................................................................................................................................................................................|.........................ddb.cca.....}}{.........ppo.......................................................~............).).@.@.P.P.`.`.p.p.................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:MS Windows icon resource - 9 icons, 256x256, 32 bits/pixel, -128x-128, 32 bits/pixel
                                                                                        Category:dropped
                                                                                        Size (bytes):456414
                                                                                        Entropy (8bit):3.1527616027149077
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:8OncC/f/XR1shuxF0x1ikxFd8kF4yWnl5polemIWPn146PjPAwwCp:8OxXB1soxa1i48Lznzpolewn144o7O
                                                                                        MD5:5E0215028A8440C924A26FC472494087
                                                                                        SHA1:1BFDA575658EB63ABAD517D2AEAEFFFBA0B99A76
                                                                                        SHA-256:59D7A7BB2403B3E772A4F77BDB268722C4F2EFE27D7E7F2A273239ABDF467B8E
                                                                                        SHA-512:2D8D032BF2312B8C013FD68A5DD408F43128B42AF0AF3C5E4828F009997999876F3C516067DC048D20495C2AA3DF5A140A2A66E5E7335E27470842E01F41857D
                                                                                        Malicious:false
                                                                                        Preview:............ .( ............ .(.... ..``.... ......(..PP.... ..g......HH.... ..T..v%..@@.... .(B...y..00.... ..%..&... .... ............... .h...v...(............. ...... ............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [HidAccessCode]
                                                                                        Category:dropped
                                                                                        Size (bytes):1480
                                                                                        Entropy (8bit):1.0365894951629362
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:eXeRlrL+ykGvOzAXhUGtbGXWWjd1LYkc7LKJDMw//+ddomNZlnUL1/Fhn:e+0iOutbhwDYkcqInY/Fh
                                                                                        MD5:97FEA5BDFB9589734CD7254941800A27
                                                                                        SHA1:A00BCD77C36F77CF54E6239A2634DD7414BC30CC
                                                                                        SHA-256:DD8B2D11E32E67C71AF6639634E1D40D09586FACC7967794388805F9C32E9FC4
                                                                                        SHA-512:E1D33591753C7A6285FDD8E0DBBE83E3228140243A11D076E12CB5179F0ECAC81B1E6B604B9B5E47B9E96133B2CECEFAA3DC5B8939ABF630B05956975492C58E
                                                                                        Malicious:false
                                                                                        Preview:[Setting]..CurrentProfile=0..MouseType=5..Device=1..FWVersion=123..[HidAccessCode]..Code=DC78CC5A0000000000000000000000007A....[OSDSetting]..config=0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006E0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):40960
                                                                                        Entropy (8bit):4.778378390442913
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:JUJOGWOdwTxQUnGKrcxKK0H8+j0qyZ1/2lM2t:u+TSUnGKrQX40F+lp
                                                                                        MD5:CDA7A1DACFF53B5A4F2FF1F0C3C4EFD7
                                                                                        SHA1:3E294FF59BB5D1C7CED55E1B06C2577E8187FBC7
                                                                                        SHA-256:807BDB98041139A913785116507738BFE1F70CE5AADA2E9FE19401E51FA3DB4D
                                                                                        SHA-512:6C55F03EE1725E0A0697148F2A0A26A0E3B58CB586591916118C030BBC329879F47487D4B9B40FC1A7603E1C45F9F41D0798BA70073010D5CF896689C0A1383A
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E....l...l...l...s..Il...p...l...l..Hl...d..l...s...l...s...l..Rich.l..................PE..L....x.Z...........!.....P...`...............`......................................................................`k...... f..<....................................................................................`...............................text....J.......P.................. ..`.rdata..U....`.......`..............@..@.data....$...p.......p..............@....HOOKDAT............................@....reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1007616
                                                                                        Entropy (8bit):5.167959511911604
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:bl3yu1t9+PYCwTdlX5s51eboHb7crRjgvqixNGe:bdBr9CwTOjebo77clIqixY
                                                                                        MD5:705A431F29F577E556CE3E22DDDC737C
                                                                                        SHA1:9509FDD15FED332A18F61A3D4EED4074806D8A3D
                                                                                        SHA-256:6C29A97A5FB8348A9E379EB8F68E81D5826B50FDDC63FCE306FCB5D3FC118073
                                                                                        SHA-512:5A7C15E0AC3DFEF9A95CA76336380F70D27F2B7691BE935769E3C737D6634C63990A07297B68F709207748D15EC92CBCED894F21A9BB06F99B6A4FA1C70ED3A0
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*7..nV..nV..nV..nV..oV...^..fV...I...V...J..vV...^..qV..nV..WT...I...V...P..oV..RichnV..........PE..L...{.{[..........................................@.............................................................................@.......0............................................................................................................text...?........................... ..`.rdata...........0..................@..@.data...........@..................@....rsrc...0............P..............@..@................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):614400
                                                                                        Entropy (8bit):4.132463943221451
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:ierXLq1CSU/e/Bz3ljl5tFxXvsix44pI+j:97qMj/EtNRFqixNGe
                                                                                        MD5:C0C6BDC385DEB10654C7558831EEFA03
                                                                                        SHA1:97B0ECCE07FFC91FFF9512E517A8483C8B758C97
                                                                                        SHA-256:092C61AEB9E35F97126345DB09D92D0CC552772BAF24B998309648AB4BB760F1
                                                                                        SHA-512:69E3F34E4697E639B4DE29114390872D54103FAE7BD50F15713C2D3365F2F509BD84C5425AE3B76BD0536D7C106437947B0E4A5484989CBF5F6ACF4C05CA771D
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G.........A.........n..L......'..K..L.....'.....w......Rich...........PE..L.....{[..........................................@......................................................................................"..............................................................................h............................text............................... ..`.rdata...W.......`..................@..@.data....q....... ..................@....rsrc....".......0...0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):57344
                                                                                        Entropy (8bit):4.447820886910707
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:42TVmkf7ex2rytDXS41z2nFvl23nigJyS3xmzMdxr:42TVmkCtDXSWChlGnigw6SMdd
                                                                                        MD5:4B1802D3E3C02CFF30186327F6CDD166
                                                                                        SHA1:2454A1D0E96E897C67D63632DF881E91FC463239
                                                                                        SHA-256:4D09D1DAA11C73EF4992BC3B157C4EA4E2D2940C83AF8616468447A3D4D83DCA
                                                                                        SHA-512:F1BE8C349D043F790878B34E719BC25A660EE756ECBCF8B8F8AFC867015D4BBFCB0263052B1EF8E715BDABFF62C0DF12A9A91F01B9B8BD9FDB80D7ABA2890408
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t..................2....................2......6.....v......Rich............PE..L......O...........!.....@...................P...............................................................................V..(.......l8...........................................................................P...............................text...Z?.......@.................. ..`.rdata.......P.......P..............@..@.data... 1...`...0...`..............@....rsrc...l8.......@..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):31891
                                                                                        Entropy (8bit):7.2958427747386745
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:PQPi4HnBiaSvdAYNg70F5Hu5A23xc0la15pzYNC83R:PQPZHZYyMuZLU5tYj3R
                                                                                        MD5:FF6E6B8272FFBE001899F94F4A916ECB
                                                                                        SHA1:526AADF64801F3B00238672653EE390671C51C24
                                                                                        SHA-256:18BCA3651334A289EE49675F05B719AD2E9C509587CD2DA11F63389E5D158B60
                                                                                        SHA-512:59E85F9797798E714513DEE4ECAF9C1D3AA4730A355ED5196ED0BD135C27DDBA753AF05F872822D57B99F99E5BF04D4EC996E55B2780D3C89B1180B6458AB580
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:25:22..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..*......rj........5....}.kH..j.5....."hZ@.L.*......r^._...k..W
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):29022
                                                                                        Entropy (8bit):7.18512588781413
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:NiPPiWiQnPiaBtdCLYNg70F5Hu5A23xc0laDgxdR:NiPPziQgYyMuZL+gxdR
                                                                                        MD5:13EA940F1AFC5840041D31B6648CE80C
                                                                                        SHA1:3FFAEFDD715C03CA2D99EC7A76F132D67EB14DB3
                                                                                        SHA-256:5E3089436EFBD8C1F691109E87A71BE00CA906B1002C3128769BFF2A4BAF5471
                                                                                        SHA-512:0A44F8D1CD4B12C3935D1C48CAD3BAB5DACE4E571E7DBCFB05E8B6E7E8BE7359F7832BD30D21F8482A359E53B425C0A7D12728DC9354F52999CA9B6955044203
                                                                                        Malicious:false
                                                                                        Preview:.....rExif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:22:24..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..*......rj........5....}.kH..j.5....."hZ@.L.*......r^._...k..W
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):31011
                                                                                        Entropy (8bit):7.233492067976867
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:JPiMnsiajNIaYNg70F5Hu5A23xc0laU36YZtkp+R:JPHMYyMuZLn6YZtkp+R
                                                                                        MD5:9033D7583E7E8C14C22716145545A76B
                                                                                        SHA1:7536D5972A56C5A6255B73BDCC7B2D94A2490940
                                                                                        SHA-256:E911ECDDCA118C46B74BD30B5A31F0337A670029F74ED7C2422A9B0D8A28D51D
                                                                                        SHA-512:3EF8591BF911A4968B9F44FCD20F88E49AB991E734D51669D0BEA418210D9AD785C8315BDB352CC9BF4DA22A33062CAE840A743EFC9F1CE4D13A5B747812D0BC
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:22:54..............0221..................................................................n...........v.(.....................~...........p.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..*......rj........5....}.kH..j.5....."hZ@.L.*......r^._...k..W
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=484, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=645], baseline, precision 8, 645x484, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):139017
                                                                                        Entropy (8bit):7.645311311102833
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:Vxfx9EQL6wT6X3V85Qu6n5nq4NFy9E0Qfkc+cNBo:z6fV8LS5quH0cvFBo
                                                                                        MD5:198C67F3F9ADA1A5AC4405B9EB051BED
                                                                                        SHA1:BB7241A4FEDC7E23B10A8BAEC138393F2A7DB467
                                                                                        SHA-256:B298D1C9B3D2EAEE9139D8550C8D76EC9E56E0BB9F912DE6E92B6DA104F11382
                                                                                        SHA-512:4B0251B226E0AC110677B04ED9E1D356751515E00D0A858992192CFEA887ECEB83800C69DD29037D5F4B9F4893C5121DA6732695B59874435D04E3B1705BE5D8
                                                                                        Malicious:false
                                                                                        Preview:.....vExif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:07:09 14:16:29..............0221...................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..L|Z.E.[.w.....}'.;..j/.._.....D....:.E..s.6=....8.......t......i.H...S.\`.
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=484, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=645], baseline, precision 8, 645x484, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):129961
                                                                                        Entropy (8bit):7.584936334560867
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:rJEjJEcYyq48vV55555JQgrNSPGu41Y0Qfk/IfBo:lycjjV55555rhFu4G0cnfBo
                                                                                        MD5:208D55BDAB7B01E746C4806DB9314359
                                                                                        SHA1:EE01D5DC44A3E37B0D2580736F454743F9D60C6A
                                                                                        SHA-256:C0DB926A2A0585EF427AFDAA4FFDE555B8C968F600A0716C037B987CECD732FC
                                                                                        SHA-512:A9F5652D0ED8D0986E810AA6F8B16006EF402FEBB0CB752DA6F04B636EE710C128CB978609211EA5E6661E16A2A6DEA04E387E7A78E0FA0CA4D0BBD938B02FD7
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:07:09 14:16:33..............0221...................................................................n...........v.(.....................~...........d.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..L|Z.E.[.w.....}'.;..j/.._.....K..K...._m.9.k.-m.k......H.n..#vQl.&.D..I..0h.
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=332, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=338], baseline, precision 8, 338x332, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):64035
                                                                                        Entropy (8bit):7.1067723959478535
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:mu7uPku7Y6FOXYyr1zaxH2zuexxxxxxxxxxeapBoERE:mufuU6FOXA4xxxxxxxxxxnp9E
                                                                                        MD5:2E22ADABBB0030704F667266DD713286
                                                                                        SHA1:E9CA7B3E1793670E87D2788129C8CA7DCE25851E
                                                                                        SHA-256:154879EFFB9E9FC193A58F5955D0262A8440991A20499D85971BDBF4F243E610
                                                                                        SHA-512:696B76519C019BB9A7473DB4DC8EDA69DEACCEE57646CF35073566C1D819810D4D765EA09D2737B1B5D42D2D87F24B4EB5012F4D9DE94A2F7D0B0E5C25C41C75
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*...............R...........L...........................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:45:54..............0221.......................R...........L...............................n...........v.(.....................~...........b.......H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..p..?J......u......T..UV?...?V?.._.....AnG......b&..........k.....%...
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 338 x 332 x 24, image size 337312, cbSize 337366, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):337366
                                                                                        Entropy (8bit):9.13402556044571E-4
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:ID9k/ac/lplll/:Iantplll
                                                                                        MD5:EF71F14FA137510A7A631C505A6256FA
                                                                                        SHA1:CA8F99FCDB2896BECEC7338C7B25FACEE960047D
                                                                                        SHA-256:E60A2C61950DDE56A146E98D96326020CB327D086EF0EF981D4039591E4C31F8
                                                                                        SHA-512:B6A516F5EA65C6BF74ADB21B60CCAA4A349278CD5D1B0C53F1418A63A6936C3E30FBCD336635BDE6BC771D3F99EF4D33F7F099A79A78E288BFF8CA792F50B30F
                                                                                        Malicious:false
                                                                                        Preview:BM.%......6...(...R...L............%....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=332, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=338], baseline, precision 8, 338x332, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):58673
                                                                                        Entropy (8bit):7.000862031846311
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:EF/zfPmF/zb6FOiYyr1zaxKwdluexxxxxxxxxxXl:sb+bb6FOiAFd/xxxxxxxxxx1
                                                                                        MD5:5E730E8DF1FB85DC775DB4B808A2888B
                                                                                        SHA1:B5BB1F60F3A48B884EB561F6D790C376CB754CE0
                                                                                        SHA-256:0CBA808F81AF11B0FFCDC8C76E332A333EDF615CB68324045FC5B4E4E2E8B73B
                                                                                        SHA-512:294DF05377145CC7174F9D41FE6AE81FD39CEE7E1C626837156E93817C2CC0770033502526BCC7C256B8DB2F6CA2FEED39AC72F7F4EFAADA2473ED42F1152A3F
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*...............R...........L...........................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:46:01..............0221.......................R...........L...............................n...........v.(.....................~...........r.......H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..p..?J......u......T..UV?...?V?.._.....AnG......b&..........k.....%...
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=332, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=338], baseline, precision 8, 338x332, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):62360
                                                                                        Entropy (8bit):7.065981152246803
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:wPp6FO8Yyr1zax71PSuexxxxxxxxxxP8I7JSbU:a6FO8ACxxxxxxxxxxPl7IbU
                                                                                        MD5:FA610C1DDF2B3AF42DC1013F485E7CBD
                                                                                        SHA1:36948D9752F0F232A2A87D928A8BB2661ED2B22C
                                                                                        SHA-256:051A3E36B041BD7C43C60D32B36347D745340D1AC19719D348FA83FE31A64A93
                                                                                        SHA-512:C234FE67A0CB060E177E55BA89CC8A5A345250131E143BDBFA094184BDE355E87338E96008528C710805C5E654949C104DEAF7EA529B0AAC95D571C31EBFC38E
                                                                                        Malicious:false
                                                                                        Preview:..... Exif..MM.*...............R...........L...........................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:45:58..............0221.......................R...........L...............................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..p..?J......u......T..UV?...?V?.._.....AnG......b&..........k.....%...
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 645 x 484 x 24, image size 937024, resolution 2835 x 2835 px/m, cbSize 937078, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):937078
                                                                                        Entropy (8bit):0.1605660968461532
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:cY0dq1ddVklMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMj:i
                                                                                        MD5:729067D1A6EB2BFE1A37EF2E5D3770BD
                                                                                        SHA1:3F1D6B3D319AA7347FC6C967B8CC0CF69D8ECE38
                                                                                        SHA-256:6D038B6D4A23C0C4B5469BD6238DDAF6ADB4F9868F179BFBBEC0B6C12C4D0392
                                                                                        SHA-512:79A136A7D7F93C0DCC977513071043F056BC8B59D17F0D9BE8B9837328A0BF7EE822C980E6980A2F3706FCF78214F8AF6E3DE8E0932E198F7A97F24CDFBF7EE1
                                                                                        Malicious:false
                                                                                        Preview:BMvL......6...(...................@L....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=484, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=645], baseline, precision 8, 645x484, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):114266
                                                                                        Entropy (8bit):7.514869840197322
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:mBSBazNC33DhIMIVK7UNP3bmuOZaPvpp9jqBo:mBSB48Thh6DTdhjqBo
                                                                                        MD5:D6B41E8CF3BC9DDB71111AC42F2DDA56
                                                                                        SHA1:033E6B61B23AB3077C8E13B399D54A6082E9F5F2
                                                                                        SHA-256:37DA3127BA39BB514BB58D1FD4C60D44FD62256A41BCA211DF49D8FAB6EDDD07
                                                                                        SHA-512:74A485A3EB0A14742A672446891836F8E71A1929E0DBD0427D52C733ACCF84FE6D2B4240A7FEAD56460AF76CBFD5A21B2847B87939E1C8BBA3F8300AC941B3AC
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:07:09 14:16:31..............0221...................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..L|Z.E.[.w.....}'.;..j/.._......;..<}[?..-a..t.1..=.)..3...o.E/......*......
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:RIFF (little-endian) data, AVI, 102 x 57, 24.00 fps, video: uncompressed
                                                                                        Category:dropped
                                                                                        Size (bytes):355840
                                                                                        Entropy (8bit):7.632776140551711
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:7NM9MxFUSH/3BoIQdwIEQG3/YkcdifbOQOM3MCMNb:fs
                                                                                        MD5:77929408772D65FC29032AFAD3AD0FFA
                                                                                        SHA1:DD35E0A04F82E3F8275941026390F91A4F9367D3
                                                                                        SHA-256:7F8A0F5AC2885B396B4D037E6C20D3064E278AE844F18FF7FB17E6C0630DAEB9
                                                                                        SHA-512:3EB3F663B7CBED2D7AE5D8E4F1ED45A1DD65A9714251B22F9909A31693F8986FA5E991B13FFB85139D4F3C77566C1B1EE1260C6FC38E3F29B7FB038DC471B1F4
                                                                                        Malicious:false
                                                                                        Preview:RIFFpm..AVI LIST ...hdrlavih8...............................D..f...9...................LIST....strlstrh8...vids.................................D..............f.9.strf....(...f...9............D........................3...f..............3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..................3...f.............3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..ff..f...f.3.f.f.f...f...f...f...f.3.f.f.f..f...f...f...f.3.f.f.f...f...f.........3...f..............3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..................3...f...................3...f..............3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...................3...f..............3...33..3f..3...3...3...f...f3..ff..f...f..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 102 x 57 x 24, image size 17558, resolution 2834 x 2834 px/m, cbSize 17612, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):17612
                                                                                        Entropy (8bit):7.60647277875558
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:Oh8toqpB7M4jiLDcZwKkr0Rwn3HGDKmAW+pvlFaMc:i34jifcZwPeyfvlAMc
                                                                                        MD5:11E8122F26343C55C4E70A8FE19520AF
                                                                                        SHA1:3F24EA77316A0BAEC3DF87C1A68724F7861024FF
                                                                                        SHA-256:59F5DDE26BD330B57DCB4195823B2C6FB1F0B40F3D69F747B0DD34C830351062
                                                                                        SHA-512:B6BDA5B776B7FF7ECEDB8320563E9EB64E64EFF1B3664499E4B7174CDA6F2A521395D618D88833F6362B29E4777C8FADAD7472279EA01D81279DF9515623E95C
                                                                                        Malicious:false
                                                                                        Preview:BM.D......6...(...f...9............D......................|..z..|..|..}..~.....|..C..(...........#.M.............9.E............U...........2.Y.5..... .!....."..6..K..R..N..@..?..=..:..9..<..?..?..L..R..M..9.$.....!. ...../.X.9...........P.7..........<.B.............H..,.............G.}........~..}..|..{..|..........}..{..|..}..~.........!.E.............K..!..........%.R..........'.W...........?.U.#...!.!. ...(..H..T..E..6.%.....................#.4..C..S..K.+... .!.!.....P.G...........S.0..........L.-.............N..........~..?..+.~.....~..}..|..{..~.....V....~..|..}..~........}..E..$..........3.A.............Q.$.........W.#.........G.M.....!."..."..J..T..<.#...!.$.%.%.%.%.%.%.%.%.%.%.$.!...!..9..R..N.%...!.!.....F.N...........W.%.........S.............8.;.............H..........~..}..|..~.............}..}...........
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
                                                                                        Category:dropped
                                                                                        Size (bytes):118604
                                                                                        Entropy (8bit):6.757263974846341
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:2a0F2hTe+5/DpoQlQSIaEjK+zM2NtIfNi:2tF28+5doQZIaEjK+Y2QVi
                                                                                        MD5:30112AE5233F60F0E9B8AA538C5D1678
                                                                                        SHA1:10287AA3D8251E1B7E0BF7DBFF2733EE346F0F49
                                                                                        SHA-256:27123DC8FBD207C6A4FAD6F9739A52F6E79EDA72ADCC71B70F6C3D0B09EB4EDC
                                                                                        SHA-512:D93B431F20744D9FC12B0AD32EDDCBDBFB7A5723662A40857CABAD9BC2E62504FF6531133A01D33C08CE893B27CBFEB033B1038D7F33CC744B2F8062450A0AD1
                                                                                        Malicious:false
                                                                                        Preview:RIFFD...WAVEfmt ........D...........data ...............................D.H.b.b...4.........0...U.e.l.k.=.J...........................t.g.].f.S.W.N._.V.b.[.{.w.....................C.R.n.u.....................!.+.2.9.K.U......./.S.L.#.!....S.Y.....E.H.........8...X.6...|.......5.a.....(.....?.7.+...$.....m.b.D.R.B.............P.,...}..... .!.......K.........w.........*.......N.Z...........;.1........v.W.P.L.:...............I.4.5.F.........}...........H.b.......4.V.f.....%.).....b.`.........$.*.\.Z.`.f.X.X.p.u.............A.D.....P.O.....|.w.6.4.............|.n.a.c.o.b.x.{.................t.s._._.=.?.....................q.l.e.b.[.W.b.[.].\.n.c.m.n.|.p.z.~...u.y.~.v.i.e.f.T.G.A.>.+....................................................... ...+...6...D.#.I.+.U.5.V.=.b.J.i.T.z.f...r.................................6./.N.E.a.W...g...}.................!...9...]...{.2...K...k.>.......L...........5.#...E.&.i.....w....... .....$...P.[.y.........&.........Q.g.r.....n.......?.....J...s.B...........
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):425
                                                                                        Entropy (8bit):5.360238719922821
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWPUWaig7no8hP77Ue5Fg7/EKUHNInlAfJEYinGTjbPOPJCCdFYMEOWnLYWSQ3:HnPG0G12/6Wnif4C/POPJfYwWL5SQ3
                                                                                        MD5:3D34E18140DF4C3B68E6A6483ED3B0F8
                                                                                        SHA1:45DF7799B1DCBAF74B938BE11E87D7D90E8C1102
                                                                                        SHA-256:D7967E2DE8A962AC1FDF46E5FB445E817222FCFA4A199CC555FDEF0EEBA96154
                                                                                        SHA-512:AB077AC7BB29B69D5906F5ECCFE16B463B3F239EF283FC9686544009B909C9EA567887EA999CF91DA6966D6D3CD918FAF419C1F828DF39682BCA6DDD1B625306
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=reset_warn_mask.bmp..Normal=key_shortcut_normal.jpg..Over=key_shortcut_over.jpg..Down=key_shortcut_down.jpg..Disable=key_shortcut_normal.jpg....[BUTTONPOS]..1=EDIT_MACRO_SET_NAME,0,0,0,0,..2=BUTTON_OK,288,111,81,23,..3=BUTTON_CANCEL,376,111,81,23,..4=BUTTON_EXIT,0,0,0,0,..5=None,87,38,20,20,..6=Ctrl,173,38,20,20,..7=Shift,259,38,20,20,..8=Alt,344,38,20,20,..9=Win+,87,72,20,20,..10=Single Key,152,75,71,18,..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):26991
                                                                                        Entropy (8bit):6.998894293801059
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:BLyiiJt9NNNNNNN228y4ldgQZLyiiJt9NNNNNNNqpknVhttY/NoSnoNYNMtKw0Oq:+PiUnViaSnoNYNg70Faczt
                                                                                        MD5:01DA37F0CBCEE32AF3CEB292507F3900
                                                                                        SHA1:3BFEBE89DC2FB8665E1AFA8F16FB46E01408F2A7
                                                                                        SHA-256:631214E4BC32B3AF953B4FA942FABA307421AF1D8C24BCBE673465D33D9AEFA6
                                                                                        SHA-512:FA99B4F664CDAA85D1DBD241DC5FA58D6EE452C0D72890343FD62017B4CF39340E8E781F63ECB255F04574EBE772B1E89A27AF61BC199D63BC2B00AC1B8E0AA4
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:26:56..............0221..................................................................n...........v.(.....................~...........S.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RI.1....F..[..zu..g....
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=332, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=338], baseline, precision 8, 338x332, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):58673
                                                                                        Entropy (8bit):7.000862031846311
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:EF/zfPmF/zb6FOiYyr1zaxKwdluexxxxxxxxxxXl:sb+bb6FOiAFd/xxxxxxxxxx1
                                                                                        MD5:5E730E8DF1FB85DC775DB4B808A2888B
                                                                                        SHA1:B5BB1F60F3A48B884EB561F6D790C376CB754CE0
                                                                                        SHA-256:0CBA808F81AF11B0FFCDC8C76E332A333EDF615CB68324045FC5B4E4E2E8B73B
                                                                                        SHA-512:294DF05377145CC7174F9D41FE6AE81FD39CEE7E1C626837156E93817C2CC0770033502526BCC7C256B8DB2F6CA2FEED39AC72F7F4EFAADA2473ED42F1152A3F
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*...............R...........L...........................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:46:01..............0221.......................R...........L...............................n...........v.(.....................~...........r.......H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..p..?J......u......T..UV?...?V?.._.....AnG......b&..........k.....%...
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 102 x 57 x 24, image size 17558, resolution 2834 x 2834 px/m, cbSize 17612, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):17612
                                                                                        Entropy (8bit):7.60647277875558
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:Oh8toqpB7M4jiLDcZwKkr0Rwn3HGDKmAW+pvlFaMc:i34jifcZwPeyfvlAMc
                                                                                        MD5:11E8122F26343C55C4E70A8FE19520AF
                                                                                        SHA1:3F24EA77316A0BAEC3DF87C1A68724F7861024FF
                                                                                        SHA-256:59F5DDE26BD330B57DCB4195823B2C6FB1F0B40F3D69F747B0DD34C830351062
                                                                                        SHA-512:B6BDA5B776B7FF7ECEDB8320563E9EB64E64EFF1B3664499E4B7174CDA6F2A521395D618D88833F6362B29E4777C8FADAD7472279EA01D81279DF9515623E95C
                                                                                        Malicious:false
                                                                                        Preview:BM.D......6...(...f...9............D......................|..z..|..|..}..~.....|..C..(...........#.M.............9.E............U...........2.Y.5..... .!....."..6..K..R..N..@..?..=..:..9..<..?..?..L..R..M..9.$.....!. ...../.X.9...........P.7..........<.B.............H..,.............G.}........~..}..|..{..|..........}..{..|..}..~.........!.E.............K..!..........%.R..........'.W...........?.U.#...!.!. ...(..H..T..E..6.%.....................#.4..C..S..K.+... .!.!.....P.G...........S.0..........L.-.............N..........~..?..+.~.....~..}..|..{..~.....V....~..|..}..~........}..E..$..........3.A.............Q.$.........W.#.........G.M.....!."..."..J..T..<.#...!.$.%.%.%.%.%.%.%.%.%.%.$.!...!..9..R..N.%...!.!.....F.N...........W.%.........S.............8.;.............H..........~..}..|..~.............}..}...........
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 11 x 19 x 24, image size 686, resolution 2834 x 2834 px/m, cbSize 740, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):740
                                                                                        Entropy (8bit):4.208111994100209
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:iatd16GGGGGGGGdWgOWWLMqJKmmmmJhh+tJ+tJdJ10glR6i38IWVGGGGGGGGdX:ieP6GGGGGGGGdWgOWWAqJKmmmmJhh+bf
                                                                                        MD5:D50F89D98907660F678200708BCD5E80
                                                                                        SHA1:6AD91EE1F6D68AC124703154C23F398D8F8F7BB1
                                                                                        SHA-256:B662592674966D6DD3CF8965D24CB2B453840CE7920838C26B390ACA514E4338
                                                                                        SHA-512:6B92011600281E0DE1C4C2CCD06A42858AD8BCFEBA76031802633C154C53E07EDD2C30E0657FF2491DFE4C6719B1CAD26F5BC3E75E87BCD1C70EF3F9B01695A5
                                                                                        Malicious:false
                                                                                        Preview:BM........6...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=484, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=645], baseline, precision 8, 645x484, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):129961
                                                                                        Entropy (8bit):7.584936334560867
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:rJEjJEcYyq48vV55555JQgrNSPGu41Y0Qfk/IfBo:lycjjV55555rhFu4G0cnfBo
                                                                                        MD5:208D55BDAB7B01E746C4806DB9314359
                                                                                        SHA1:EE01D5DC44A3E37B0D2580736F454743F9D60C6A
                                                                                        SHA-256:C0DB926A2A0585EF427AFDAA4FFDE555B8C968F600A0716C037B987CECD732FC
                                                                                        SHA-512:A9F5652D0ED8D0986E810AA6F8B16006EF402FEBB0CB752DA6F04B636EE710C128CB978609211EA5E6661E16A2A6DEA04E387E7A78E0FA0CA4D0BBD938B02FD7
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:07:09 14:16:33..............0221...................................................................n...........v.(.....................~...........d.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..L|Z.E.[.w.....}'.;..j/.._.....K..K...._m.9.k.-m.k......H.n..#vQl.&.D..I..0h.
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=484, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=645], baseline, precision 8, 645x484, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):114266
                                                                                        Entropy (8bit):7.514869840197322
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:mBSBazNC33DhIMIVK7UNP3bmuOZaPvpp9jqBo:mBSB48Thh6DTdhjqBo
                                                                                        MD5:D6B41E8CF3BC9DDB71111AC42F2DDA56
                                                                                        SHA1:033E6B61B23AB3077C8E13B399D54A6082E9F5F2
                                                                                        SHA-256:37DA3127BA39BB514BB58D1FD4C60D44FD62256A41BCA211DF49D8FAB6EDDD07
                                                                                        SHA-512:74A485A3EB0A14742A672446891836F8E71A1929E0DBD0427D52C733ACCF84FE6D2B4240A7FEAD56460AF76CBFD5A21B2847B87939E1C8BBA3F8300AC941B3AC
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:07:09 14:16:31..............0221...................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..L|Z.E.[.w.....}'.;..j/.._......;..<}[?..-a..t.1..=.)..3...o.E/......*......
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
                                                                                        Category:dropped
                                                                                        Size (bytes):118604
                                                                                        Entropy (8bit):6.757263974846341
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:2a0F2hTe+5/DpoQlQSIaEjK+zM2NtIfNi:2tF28+5doQZIaEjK+Y2QVi
                                                                                        MD5:30112AE5233F60F0E9B8AA538C5D1678
                                                                                        SHA1:10287AA3D8251E1B7E0BF7DBFF2733EE346F0F49
                                                                                        SHA-256:27123DC8FBD207C6A4FAD6F9739A52F6E79EDA72ADCC71B70F6C3D0B09EB4EDC
                                                                                        SHA-512:D93B431F20744D9FC12B0AD32EDDCBDBFB7A5723662A40857CABAD9BC2E62504FF6531133A01D33C08CE893B27CBFEB033B1038D7F33CC744B2F8062450A0AD1
                                                                                        Malicious:false
                                                                                        Preview:RIFFD...WAVEfmt ........D...........data ...............................D.H.b.b...4.........0...U.e.l.k.=.J...........................t.g.].f.S.W.N._.V.b.[.{.w.....................C.R.n.u.....................!.+.2.9.K.U......./.S.L.#.!....S.Y.....E.H.........8...X.6...|.......5.a.....(.....?.7.+...$.....m.b.D.R.B.............P.,...}..... .!.......K.........w.........*.......N.Z...........;.1........v.W.P.L.:...............I.4.5.F.........}...........H.b.......4.V.f.....%.).....b.`.........$.*.\.Z.`.f.X.X.p.u.............A.D.....P.O.....|.w.6.4.............|.n.a.c.o.b.x.{.................t.s._._.=.?.....................q.l.e.b.[.W.b.[.].\.n.c.m.n.|.p.z.~...u.y.~.v.i.e.f.T.G.A.>.+....................................................... ...+...6...D.#.I.+.U.5.V.=.b.J.i.T.z.f...r.................................6./.N.E.a.W...g...}.................!...9...]...{.2...K...k.>.......L...........5.#...E.&.i.....w....... .....$...P.[.y.........&.........Q.g.r.....n.......?.....J...s.B...........
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 475 x 150 x 24, image size 214200, cbSize 214254, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):214254
                                                                                        Entropy (8bit):0.0013128067959919045
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:RlQklRaFlG:DQsRafG
                                                                                        MD5:05A046EFC14725DEDA982EA9044857FB
                                                                                        SHA1:FD115023F4D5F76393398E13EC2E5062C1B13286
                                                                                        SHA-256:16088313FFDD2C105D0A629BAFF7B7CA25A6EE05A4897FA5B4AE589F01EF9A04
                                                                                        SHA-512:1D7CEB88B0D6FA4EB3399C25D4A370DC0F4DBEF2626BA51B762BF2D421A331049C792C85FED44D340993DAAAC6BC225F8C0DBB57E7CE987635AD041F04B13597
                                                                                        Malicious:false
                                                                                        Preview:BM.D......6...(....................D....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 475 x 150 x 24, image size 214200, cbSize 214254, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):214254
                                                                                        Entropy (8bit):0.0013128067959919045
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:RlQklRaFlG:DQsRafG
                                                                                        MD5:05A046EFC14725DEDA982EA9044857FB
                                                                                        SHA1:FD115023F4D5F76393398E13EC2E5062C1B13286
                                                                                        SHA-256:16088313FFDD2C105D0A629BAFF7B7CA25A6EE05A4897FA5B4AE589F01EF9A04
                                                                                        SHA-512:1D7CEB88B0D6FA4EB3399C25D4A370DC0F4DBEF2626BA51B762BF2D421A331049C792C85FED44D340993DAAAC6BC225F8C0DBB57E7CE987635AD041F04B13597
                                                                                        Malicious:false
                                                                                        Preview:BM.D......6...(....................D....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 338 x 332 x 24, image size 337312, cbSize 337366, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):337366
                                                                                        Entropy (8bit):9.13402556044571E-4
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:ID9k/ac/lplll/:Iantplll
                                                                                        MD5:EF71F14FA137510A7A631C505A6256FA
                                                                                        SHA1:CA8F99FCDB2896BECEC7338C7B25FACEE960047D
                                                                                        SHA-256:E60A2C61950DDE56A146E98D96326020CB327D086EF0EF981D4039591E4C31F8
                                                                                        SHA-512:B6A516F5EA65C6BF74ADB21B60CCAA4A349278CD5D1B0C53F1418A63A6936C3E30FBCD336635BDE6BC771D3F99EF4D33F7F099A79A78E288BFF8CA792F50B30F
                                                                                        Malicious:false
                                                                                        Preview:BM.%......6...(...R...L............%....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:RIFF (little-endian) data, AVI, 102 x 57, 24.00 fps, video: uncompressed
                                                                                        Category:dropped
                                                                                        Size (bytes):355840
                                                                                        Entropy (8bit):7.632776140551711
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:7NM9MxFUSH/3BoIQdwIEQG3/YkcdifbOQOM3MCMNb:fs
                                                                                        MD5:77929408772D65FC29032AFAD3AD0FFA
                                                                                        SHA1:DD35E0A04F82E3F8275941026390F91A4F9367D3
                                                                                        SHA-256:7F8A0F5AC2885B396B4D037E6C20D3064E278AE844F18FF7FB17E6C0630DAEB9
                                                                                        SHA-512:3EB3F663B7CBED2D7AE5D8E4F1ED45A1DD65A9714251B22F9909A31693F8986FA5E991B13FFB85139D4F3C77566C1B1EE1260C6FC38E3F29B7FB038DC471B1F4
                                                                                        Malicious:false
                                                                                        Preview:RIFFpm..AVI LIST ...hdrlavih8...............................D..f...9...................LIST....strlstrh8...vids.................................D..............f.9.strf....(...f...9............D........................3...f..............3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..................3...f.............3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..ff..f...f.3.f.f.f...f...f...f...f.3.f.f.f..f...f...f...f.3.f.f.f...f...f.........3...f..............3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..................3...f...................3...f..............3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...................3...f..............3...33..3f..3...3...3...f...f3..ff..f...f..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):579
                                                                                        Entropy (8bit):5.222030511989475
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:HhcvjkSYtjGErkS/6HAJMnPBfpppDQrRn+Uhu/tfglEb4CKKEJz0lCnUWWgc:6vISHSiguphDD6RnD4gl24CKKNCnUd
                                                                                        MD5:EB138B07D393C4A13F42F37127B3315D
                                                                                        SHA1:E868B8BD51E32A05F17A61BD763EEB3A264AC0D5
                                                                                        SHA-256:7FF3A111CE9F0FEA692D817160B17E827E37C7441B19FCBB6BC945510FDC0C11
                                                                                        SHA-512:E8C474D8BD0C8883E9D2DF59EC56FDC7559C91628214B5AB1187F5EF97185E85BE5693063F89FF2C65927C2691607377D68A5D81906361D308E95FA2DBE60735
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=macro_manager_mask.bmp..Normal=macro_manager_normal.jpg..Over=macro_manager_over.jpg..Down=macro_manager_down.jpg..Disable=macro_manager_normal.jpg....[BUTTONPOS]..1=OK,226,298,43,20,..2=Cancel,282,298,43,20,..3=Exit,0,0,0,0,..4=BUTTON_New,8,298,43,20,..5=BUTTON_Delete,62,298,43,20,..6=BUTTON_List_MacroName,11,40,101,241,..7=BUTTON_Start_Record,232,47,91,21,....8=BUTTON_Delay_ON_OFF,231,79,15,15,..9=BUTTON_LoopTimes_ON_OFF,232,214,15,15,..10=Edit_Times,255,234,64,19,..11=BUTTON_List_key_sequence,119,40,101,241,..12=LOAD,115,298,43,20,..13=SAVE,171,298,43,20,
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):247
                                                                                        Entropy (8bit):5.318374125358607
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWRQV1ZDVg7n9MGYDKMthF0ZDDL77UFZDVg7/EKUHWAfJExHpinGTjeOPn:HJQ9C6bGvLYZC/6Xf+wCCOPn
                                                                                        MD5:F3312B2BE992155ACD0D9ACA5CCC8C6C
                                                                                        SHA1:6CFB8E2F8D99075572E909A0CE65C54671DA2591
                                                                                        SHA-256:30196402442A573DE2E3E0B13F8C8AC5248CB02CF8461E3D002231604B3A3404
                                                                                        SHA-512:1512DB3B7BD08E19D709DAB042C86DAB9AFCD8B779A07800BF79B57153E25CA90DB6920631C16747CCB208202A1563BE3FD1FDC17727C3090D2191A92AC31D14
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=small_popup_mask.bmp..Normal=Click_Warn_normal.jpg..Over=Click_Warn_over.jpg..Down=Click_Warn_down.jpg..Disable=Click_Warn_normal.jpg....[BUTTONPOS]..1=BUTTON_OK,288,111,81,23,..2=BUTTON_CANCEL,376,111,81,23,..3=BUTTON_EXIT,0,0,0,0,
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):29022
                                                                                        Entropy (8bit):7.18512588781413
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:NiPPiWiQnPiaBtdCLYNg70F5Hu5A23xc0laDgxdR:NiPPziQgYyMuZL+gxdR
                                                                                        MD5:13EA940F1AFC5840041D31B6648CE80C
                                                                                        SHA1:3FFAEFDD715C03CA2D99EC7A76F132D67EB14DB3
                                                                                        SHA-256:5E3089436EFBD8C1F691109E87A71BE00CA906B1002C3128769BFF2A4BAF5471
                                                                                        SHA-512:0A44F8D1CD4B12C3935D1C48CAD3BAB5DACE4E571E7DBCFB05E8B6E7E8BE7359F7832BD30D21F8482A359E53B425C0A7D12728DC9354F52999CA9B6955044203
                                                                                        Malicious:false
                                                                                        Preview:.....rExif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:22:24..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..*......rj........5....}.kH..j.5....."hZ@.L.*......r^._...k..W
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):27880
                                                                                        Entropy (8bit):7.086491401052815
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:kPipn4jiarRHCYNg70FadqbFzpJ88KcODDc:kPO4mYyl85yDDc
                                                                                        MD5:7A805F09E8EB68B47DBEADCEF6C4AA8B
                                                                                        SHA1:A64665D175E5972EAF51A0484B37B952EE2AB93F
                                                                                        SHA-256:4457B62FB990DC9962EF7AEEC115B43017735F92B184465B9C5C7C3C217CBE86
                                                                                        SHA-512:897945689D0212A68552E5CCE28804C63CA9CF8D99A3EE35EBE26BAA62E0DC4EAECBDFE2C8F867B8577CF047B4B3735EE0DDFFE78E9C30CD2A8713D24706ADE3
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:27:20..............0221..................................................................n...........v.(.....................~...........h.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RI.1....F..[..zu..g....
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):248
                                                                                        Entropy (8bit):5.319965928228987
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWPUWa1ZDVg7n9MGYDKMthF0ZDDL77UFZDVg7/EKUHWAfJExHpinGTjeOPy:HnPkC6bGvLYZC/6Xf+wCCOPy
                                                                                        MD5:98341D30827494250CC2A71E33820C40
                                                                                        SHA1:F48469D0BED2E38B0676A15ADEA444F22247F0D8
                                                                                        SHA-256:BCEC5841DE2068DC252F5B8D9C4BC647E990DF4793FEF74F19AA3ECB3714A789
                                                                                        SHA-512:DC464FC6ED0D1E43EF81332BBCA2360D9DC804E4D133CB9B728915571EF5565CE76155C4CB584EA0884FF1B5DC69E701C4F26E499B050413FD81B78CC6E0761B
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=reset_warn_mask.bmp..Normal=Click_Warn_normal.jpg..Over=Click_Warn_over.jpg..Down=Click_Warn_down.jpg..Disable=Click_Warn_normal.jpg....[BUTTONPOS]..1=BUTTON_OK,288,111,81,23,..2=BUTTON_CANCEL,376,111,81,23,..3=BUTTON_EXIT,0,0,0,0,..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):24999
                                                                                        Entropy (8bit):6.905482024625715
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:SLyiiJtVV/NNNNNNNE28y4lJyXgMtLyiiJtVV/NNNNNNN2pknVJjtY/No4Cli2Yn:RTPidFnbia4Ai2YNg70FaLvFg
                                                                                        MD5:F3E33D890BC25BC4B6EF82D3ECD8C8C3
                                                                                        SHA1:AF14B669B2A3D0054D622FEC99BB49D6DAD6F287
                                                                                        SHA-256:DD5DBF6C040498776E7F284B8D7419093946C00B8E3D132FCC14B846B2417758
                                                                                        SHA-512:1B01039D0C682326EA55D41D0658D15AFB6B92E603CCA8A3403CA1DF0257A0A74E597CE5ACB5DD41648D6EBC258B9B286125E7457441692901422C8C121DCE47
                                                                                        Malicious:false
                                                                                        Preview:.....XExif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:26:34..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RI.1....F..[..zu..g....
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):248
                                                                                        Entropy (8bit):5.319965928228987
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWPUWa1ZDVg7n9MGYDKMthF0ZDDL77UFZDVg7/EKUHWAfJExHpinGTjeOPy:HnPkC6bGvLYZC/6Xf+wCCOPy
                                                                                        MD5:98341D30827494250CC2A71E33820C40
                                                                                        SHA1:F48469D0BED2E38B0676A15ADEA444F22247F0D8
                                                                                        SHA-256:BCEC5841DE2068DC252F5B8D9C4BC647E990DF4793FEF74F19AA3ECB3714A789
                                                                                        SHA-512:DC464FC6ED0D1E43EF81332BBCA2360D9DC804E4D133CB9B728915571EF5565CE76155C4CB584EA0884FF1B5DC69E701C4F26E499B050413FD81B78CC6E0761B
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=reset_warn_mask.bmp..Normal=Click_Warn_normal.jpg..Over=Click_Warn_over.jpg..Down=Click_Warn_down.jpg..Disable=Click_Warn_normal.jpg....[BUTTONPOS]..1=BUTTON_OK,288,111,81,23,..2=BUTTON_CANCEL,376,111,81,23,..3=BUTTON_EXIT,0,0,0,0,..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):247
                                                                                        Entropy (8bit):5.318374125358607
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWRQV1ZDVg7n9MGYDKMthF0ZDDL77UFZDVg7/EKUHWAfJExHpinGTjeOPn:HJQ9C6bGvLYZC/6Xf+wCCOPn
                                                                                        MD5:F3312B2BE992155ACD0D9ACA5CCC8C6C
                                                                                        SHA1:6CFB8E2F8D99075572E909A0CE65C54671DA2591
                                                                                        SHA-256:30196402442A573DE2E3E0B13F8C8AC5248CB02CF8461E3D002231604B3A3404
                                                                                        SHA-512:1512DB3B7BD08E19D709DAB042C86DAB9AFCD8B779A07800BF79B57153E25CA90DB6920631C16747CCB208202A1563BE3FD1FDC17727C3090D2191A92AC31D14
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=small_popup_mask.bmp..Normal=Click_Warn_normal.jpg..Over=Click_Warn_over.jpg..Down=Click_Warn_down.jpg..Disable=Click_Warn_normal.jpg....[BUTTONPOS]..1=BUTTON_OK,288,111,81,23,..2=BUTTON_CANCEL,376,111,81,23,..3=BUTTON_EXIT,0,0,0,0,
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):33731
                                                                                        Entropy (8bit):7.327749687849388
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:lqbPiMqTnOiarRNCYNg70FY+znw4QVu8Ij7cKhUPwkw1TBxoJgN:lqbPrqThYyhTrVu8Ijo6BFDoqN
                                                                                        MD5:29F0FE7692ABBDA7E5EC1B6CBDC5E6BB
                                                                                        SHA1:20340B121FEF6AC3B3D73977A648AD02245464A5
                                                                                        SHA-256:E44EEC7F80DEA549AF6ECBF0014FCC204D11CCBCC9A6BE51518B6CFAE06E4091
                                                                                        SHA-512:B72D991473FB6694222A44C7CB666CF1A7200E4902E1398E8E58C64674B2BBFC7D9F75F046EA60EEF795E829D66E5D48CE96FDA15ABA5DE4851A1FD07EF0BD8C
                                                                                        Malicious:false
                                                                                        Preview:.....ZExif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:33:17..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RA....Z..7s[...q..P..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=484, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=645], baseline, precision 8, 645x484, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):139017
                                                                                        Entropy (8bit):7.645311311102833
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:Vxfx9EQL6wT6X3V85Qu6n5nq4NFy9E0Qfkc+cNBo:z6fV8LS5quH0cvFBo
                                                                                        MD5:198C67F3F9ADA1A5AC4405B9EB051BED
                                                                                        SHA1:BB7241A4FEDC7E23B10A8BAEC138393F2A7DB467
                                                                                        SHA-256:B298D1C9B3D2EAEE9139D8550C8D76EC9E56E0BB9F912DE6E92B6DA104F11382
                                                                                        SHA-512:4B0251B226E0AC110677B04ED9E1D356751515E00D0A858992192CFEA887ECEB83800C69DD29037D5F4B9F4893C5121DA6732695B59874435D04E3B1705BE5D8
                                                                                        Malicious:false
                                                                                        Preview:.....vExif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:07:09 14:16:29..............0221...................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..L|Z.E.[.w.....}'.;..j/.._.....D....:.E..s.6=....8.......t......i.H...S.\`.
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=332, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=338], baseline, precision 8, 338x332, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):62360
                                                                                        Entropy (8bit):7.065981152246803
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:wPp6FO8Yyr1zax71PSuexxxxxxxxxxP8I7JSbU:a6FO8ACxxxxxxxxxxPl7IbU
                                                                                        MD5:FA610C1DDF2B3AF42DC1013F485E7CBD
                                                                                        SHA1:36948D9752F0F232A2A87D928A8BB2661ED2B22C
                                                                                        SHA-256:051A3E36B041BD7C43C60D32B36347D745340D1AC19719D348FA83FE31A64A93
                                                                                        SHA-512:C234FE67A0CB060E177E55BA89CC8A5A345250131E143BDBFA094184BDE355E87338E96008528C710805C5E654949C104DEAF7EA529B0AAC95D571C31EBFC38E
                                                                                        Malicious:false
                                                                                        Preview:..... Exif..MM.*...............R...........L...........................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:45:58..............0221.......................R...........L...............................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..p..?J......u......T..UV?...?V?.._.....AnG......b&..........k.....%...
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):26852
                                                                                        Entropy (8bit):7.042437199432014
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:8319Pi+1Vnaia4A+2YNg70F3ocPpERDtPpQI7HN21S:8319Px1VIYyMpgQcHQ8
                                                                                        MD5:EAE3D0099E7C41A0A489D7ED06A57995
                                                                                        SHA1:FA701F61C50AEAA16A795307FEE01465ED40C24D
                                                                                        SHA-256:4013FCB1A713F66868C5B0E6803682353BA96CC27AFE450A3B1B83FEE918F668
                                                                                        SHA-512:D8FB45145C3767A8C859DA4B2E09CC6D5BE7C4FA08B501047507D9BF6FEAD53385D77789052D7131A21B156DB9EB910FF81EF8A012D75161068AA628460AFE04
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:26:38..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RLLD.I0......$..:.....
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):395
                                                                                        Entropy (8bit):5.2156498794041575
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWPUWa/jn7nTR5hcu7UGCn7/EKUHNInlAfJEYinGTjbPOPJQM5Uvovn:HnPknShn/6Wnif4C/POPJQy0y
                                                                                        MD5:ECF65DEB1E35AE528BB4C428AA9A7DE6
                                                                                        SHA1:902A6BFD932AD76E8BF97D74E1B7700730C8929C
                                                                                        SHA-256:E831225EB545E7BBE1DA93C94CC7BAF9FA77FDB5BC7F288B147DC5192F96EB26
                                                                                        SHA-512:A89823BC49DD80B37D998565102082FBDAD8167B327D4E743CD7DB3099F94FB0ADC5468BAEDEFD3EA550E7011522F9DF0B5A43BB383FBE9480A2507884A82380
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=reset_warn_mask.bmp..Normal=single_key_normal.jpg..Over=single_key_over.jpg..Down=single_key_down.jpg..Disable=single_key_normal.jpg....[BUTTONPOS]..1=EDIT_MACRO_SET_NAME,0,0,0,0,..2=BUTTON_OK,288,111,81,23,..3=BUTTON_CANCEL,376,111,81,23,..4=BUTTON_EXIT,0,0,0,0,..5=None,0,0,0,0,..6=Ctrl,0,0,0,0,..7=Shift,0,0,0,0,..8=Alt,0,0,0,0,..9=Win+,0,0,0,0,..10=Single Key,127,57,210,24,..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):31029
                                                                                        Entropy (8bit):7.192914985118967
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:YAgPiFA0nJiaSn8NYNg70FYChtQVu8IO5pq9inylyiN:YPivYyhKmVu8IPiy8iN
                                                                                        MD5:35CCDE5F3A814E0D6ACD18D99833F9D0
                                                                                        SHA1:E9BCF38C5735D0B43E704BC1D91FB00E9155547A
                                                                                        SHA-256:F1081930657D33A43427E4F47899CB21DF598A11C3A69BDD9375F57047F73052
                                                                                        SHA-512:8FEC42AAC2EB1776FC263534F147111608470BE531F6B3F1143BD6D516DA81D344F16E54C56664194A8A49FD391D3D8B33BB671F65506A7FACF641A47AA7320C
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:34:30..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RA....Z..7s[...q..P..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):1555
                                                                                        Entropy (8bit):4.803906701986935
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:1SXvO8Y3viLGpJQu1TNRFLFKumF3NSqMJqpksL1Dcw2NJaU9h2/I8tJ:8EiA1tgum9NNMJ+k6VqJaKStJ
                                                                                        MD5:F6339D59DB697930227C8A7F618938C2
                                                                                        SHA1:C1C7B716C0738B864C9293A6AF7D191531AC5E17
                                                                                        SHA-256:89510A169E045F77164D2D2AF41CC4AC9CFAF17FC81552927AE4B654D117F6CD
                                                                                        SHA-512:2B265F8EB77C6F4B83579FF539E6E6914B81B574444EC5F828F90FA65B07393E336598926C741C9FB1F2AEDBE82663453639CB77808E5DA229A9B548CCE87F9F
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=config_mask.bmp..Normal=config_normal.jpg..Over=config_over.jpg..Down=config_down.jpg..Disable=config_normal.jpg....[BUTTONPOS]..1=Create,0,0,0,0,,..2=Load,0,0,0,0,,..3=Save,0,0,0,0,,..4=Edit,0,0,0,0,,....5=Profile 1,0,0,0,0,,..6=Profile 2,0,0,0,0,,..7=Profile 3,0,0,0,0,,..8=Profile 4,0,0,0,0,,..9=Profile 5,0,0,0,0,,....10=Min,564,9,26,17,,..11=Exit,595,9,34,17,,..12=OK,0,0,0,0,,..13=Cancel,530,442,88,21,,..14=Apply,430,442,88,21,,......15=Profile 1 name,0,0,0,0,,..16=Profile 2 name,0,0,0,0,,..17=Profile 3 name,0,0,0,0,,..18=Profile 4 name,0,0,0,0,,..19=Profile 5 name,0,0,0,0,,......20=Click,13,56,164,25,..21=Menu,13,91,164,25,..22=Middle,13,125,164,25,..23=Backwrd,13,195,164,25,..24=FORWARD,13,160,164,25,..25=Cpi,0,0,0,0,..26=Encode1,0,0,0,0,..27=Encode2,0,0,0,0,..28=Backwrd,0,0,0,0,..29=Backwrd,0,0,0,0,..30=Backwrd,0,0,0,0,..31=Backwrd,0,0,0,0,..32=Backwrd,0,0,0,0,..33=Backwrd,13,228,164,28,..34=Backwrd,13,263,164,28,....35=Right hand,0,0,0,0,..36=Left hand,0,0,0,0,...
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=332, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=338], baseline, precision 8, 338x332, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):64035
                                                                                        Entropy (8bit):7.1067723959478535
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:mu7uPku7Y6FOXYyr1zaxH2zuexxxxxxxxxxeapBoERE:mufuU6FOXA4xxxxxxxxxxnp9E
                                                                                        MD5:2E22ADABBB0030704F667266DD713286
                                                                                        SHA1:E9CA7B3E1793670E87D2788129C8CA7DCE25851E
                                                                                        SHA-256:154879EFFB9E9FC193A58F5955D0262A8440991A20499D85971BDBF4F243E610
                                                                                        SHA-512:696B76519C019BB9A7473DB4DC8EDA69DEACCEE57646CF35073566C1D819810D4D765EA09D2737B1B5D42D2D87F24B4EB5012F4D9DE94A2F7D0B0E5C25C41C75
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*...............R...........L...........................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:45:54..............0221.......................R...........L...............................n...........v.(.....................~...........b.......H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..p..?J......u......T..UV?...?V?.._.....AnG......b&..........k.....%...
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):31891
                                                                                        Entropy (8bit):7.2958427747386745
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:PQPi4HnBiaSvdAYNg70F5Hu5A23xc0la15pzYNC83R:PQPZHZYyMuZLU5tYj3R
                                                                                        MD5:FF6E6B8272FFBE001899F94F4A916ECB
                                                                                        SHA1:526AADF64801F3B00238672653EE390671C51C24
                                                                                        SHA-256:18BCA3651334A289EE49675F05B719AD2E9C509587CD2DA11F63389E5D158B60
                                                                                        SHA-512:59E85F9797798E714513DEE4ECAF9C1D3AA4730A355ED5196ED0BD135C27DDBA753AF05F872822D57B99F99E5BF04D4EC996E55B2780D3C89B1180B6458AB580
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:25:22..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..*......rj........5....}.kH..j.5....."hZ@.L.*......r^._...k..W
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 645 x 484 x 24, image size 937024, resolution 2835 x 2835 px/m, cbSize 937078, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):937078
                                                                                        Entropy (8bit):0.1605660968461532
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:cY0dq1ddVklMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMj:i
                                                                                        MD5:729067D1A6EB2BFE1A37EF2E5D3770BD
                                                                                        SHA1:3F1D6B3D319AA7347FC6C967B8CC0CF69D8ECE38
                                                                                        SHA-256:6D038B6D4A23C0C4B5469BD6238DDAF6ADB4F9868F179BFBBEC0B6C12C4D0392
                                                                                        SHA-512:79A136A7D7F93C0DCC977513071043F056BC8B59D17F0D9BE8B9837328A0BF7EE822C980E6980A2F3706FCF78214F8AF6E3DE8E0932E198F7A97F24CDFBF7EE1
                                                                                        Malicious:false
                                                                                        Preview:BMvL......6...(...................@L....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):31011
                                                                                        Entropy (8bit):7.233492067976867
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:JPiMnsiajNIaYNg70F5Hu5A23xc0laU36YZtkp+R:JPHMYyMuZLn6YZtkp+R
                                                                                        MD5:9033D7583E7E8C14C22716145545A76B
                                                                                        SHA1:7536D5972A56C5A6255B73BDCC7B2D94A2490940
                                                                                        SHA-256:E911ECDDCA118C46B74BD30B5A31F0337A670029F74ED7C2422A9B0D8A28D51D
                                                                                        SHA-512:3EF8591BF911A4968B9F44FCD20F88E49AB991E734D51669D0BEA418210D9AD785C8315BDB352CC9BF4DA22A33062CAE840A743EFC9F1CE4D13A5B747812D0BC
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:22:54..............0221..................................................................n...........v.(.....................~...........p.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..*......rj........5....}.kH..j.5....."hZ@.L.*......r^._...k..W
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):33731
                                                                                        Entropy (8bit):7.327749687849388
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:lqbPiMqTnOiarRNCYNg70FY+znw4QVu8Ij7cKhUPwkw1TBxoJgN:lqbPrqThYyhTrVu8Ijo6BFDoqN
                                                                                        MD5:29F0FE7692ABBDA7E5EC1B6CBDC5E6BB
                                                                                        SHA1:20340B121FEF6AC3B3D73977A648AD02245464A5
                                                                                        SHA-256:E44EEC7F80DEA549AF6ECBF0014FCC204D11CCBCC9A6BE51518B6CFAE06E4091
                                                                                        SHA-512:B72D991473FB6694222A44C7CB666CF1A7200E4902E1398E8E58C64674B2BBFC7D9F75F046EA60EEF795E829D66E5D48CE96FDA15ABA5DE4851A1FD07EF0BD8C
                                                                                        Malicious:false
                                                                                        Preview:.....ZExif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:33:17..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RA....Z..7s[...q..P..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):26852
                                                                                        Entropy (8bit):7.042437199432014
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:8319Pi+1Vnaia4A+2YNg70F3ocPpERDtPpQI7HN21S:8319Px1VIYyMpgQcHQ8
                                                                                        MD5:EAE3D0099E7C41A0A489D7ED06A57995
                                                                                        SHA1:FA701F61C50AEAA16A795307FEE01465ED40C24D
                                                                                        SHA-256:4013FCB1A713F66868C5B0E6803682353BA96CC27AFE450A3B1B83FEE918F668
                                                                                        SHA-512:D8FB45145C3767A8C859DA4B2E09CC6D5BE7C4FA08B501047507D9BF6FEAD53385D77789052D7131A21B156DB9EB910FF81EF8A012D75161068AA628460AFE04
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:26:38..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RLLD.I0......$..:.....
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):31029
                                                                                        Entropy (8bit):7.192914985118967
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:YAgPiFA0nJiaSn8NYNg70FYChtQVu8IO5pq9inylyiN:YPivYyhKmVu8IPiy8iN
                                                                                        MD5:35CCDE5F3A814E0D6ACD18D99833F9D0
                                                                                        SHA1:E9BCF38C5735D0B43E704BC1D91FB00E9155547A
                                                                                        SHA-256:F1081930657D33A43427E4F47899CB21DF598A11C3A69BDD9375F57047F73052
                                                                                        SHA-512:8FEC42AAC2EB1776FC263534F147111608470BE531F6B3F1143BD6D516DA81D344F16E54C56664194A8A49FD391D3D8B33BB671F65506A7FACF641A47AA7320C
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:09 11:34:30..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RA....Z..7s[...q..P..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 475 x 150 x 24, image size 214200, cbSize 214254, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):214254
                                                                                        Entropy (8bit):0.0013128067959919045
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:RlQklRaFlG:DQsRafG
                                                                                        MD5:05A046EFC14725DEDA982EA9044857FB
                                                                                        SHA1:FD115023F4D5F76393398E13EC2E5062C1B13286
                                                                                        SHA-256:16088313FFDD2C105D0A629BAFF7B7CA25A6EE05A4897FA5B4AE589F01EF9A04
                                                                                        SHA-512:1D7CEB88B0D6FA4EB3399C25D4A370DC0F4DBEF2626BA51B762BF2D421A331049C792C85FED44D340993DAAAC6BC225F8C0DBB57E7CE987635AD041F04B13597
                                                                                        Malicious:false
                                                                                        Preview:BM.D......6...(....................D....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 11 x 19 x 24, image size 686, resolution 2834 x 2834 px/m, cbSize 740, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):740
                                                                                        Entropy (8bit):4.208111994100209
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:iatd16GGGGGGGGdWgOWWLMqJKmmmmJhh+tJ+tJdJ10glR6i38IWVGGGGGGGGdX:ieP6GGGGGGGGdWgOWWAqJKmmmmJhh+bf
                                                                                        MD5:D50F89D98907660F678200708BCD5E80
                                                                                        SHA1:6AD91EE1F6D68AC124703154C23F398D8F8F7BB1
                                                                                        SHA-256:B662592674966D6DD3CF8965D24CB2B453840CE7920838C26B390ACA514E4338
                                                                                        SHA-512:6B92011600281E0DE1C4C2CCD06A42858AD8BCFEBA76031802633C154C53E07EDD2C30E0657FF2491DFE4C6719B1CAD26F5BC3E75E87BCD1C70EF3F9B01695A5
                                                                                        Malicious:false
                                                                                        Preview:BM........6...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):27880
                                                                                        Entropy (8bit):7.086491401052815
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:kPipn4jiarRHCYNg70FadqbFzpJ88KcODDc:kPO4mYyl85yDDc
                                                                                        MD5:7A805F09E8EB68B47DBEADCEF6C4AA8B
                                                                                        SHA1:A64665D175E5972EAF51A0484B37B952EE2AB93F
                                                                                        SHA-256:4457B62FB990DC9962EF7AEEC115B43017735F92B184465B9C5C7C3C217CBE86
                                                                                        SHA-512:897945689D0212A68552E5CCE28804C63CA9CF8D99A3EE35EBE26BAA62E0DC4EAECBDFE2C8F867B8577CF047B4B3735EE0DDFFE78E9C30CD2A8713D24706ADE3
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:27:20..............0221..................................................................n...........v.(.....................~...........h.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RI.1....F..[..zu..g....
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):24999
                                                                                        Entropy (8bit):6.905482024625715
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:SLyiiJtVV/NNNNNNNE28y4lJyXgMtLyiiJtVV/NNNNNNN2pknVJjtY/No4Cli2Yn:RTPidFnbia4Ai2YNg70FaLvFg
                                                                                        MD5:F3E33D890BC25BC4B6EF82D3ECD8C8C3
                                                                                        SHA1:AF14B669B2A3D0054D622FEC99BB49D6DAD6F287
                                                                                        SHA-256:DD5DBF6C040498776E7F284B8D7419093946C00B8E3D132FCC14B846B2417758
                                                                                        SHA-512:1B01039D0C682326EA55D41D0658D15AFB6B92E603CCA8A3403CA1DF0257A0A74E597CE5ACB5DD41648D6EBC258B9B286125E7457441692901422C8C121DCE47
                                                                                        Malicious:false
                                                                                        Preview:.....XExif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:26:34..............0221..................................................................n...........v.(.....................~...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RI.1....F..[..zu..g....
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=150, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=475], baseline, precision 8, 475x150, components 3
                                                                                        Category:dropped
                                                                                        Size (bytes):26991
                                                                                        Entropy (8bit):6.998894293801059
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:BLyiiJt9NNNNNNN228y4ldgQZLyiiJt9NNNNNNNqpknVhttY/NoSnoNYNMtKw0Oq:+PiUnViaSnoNYNg70Faczt
                                                                                        MD5:01DA37F0CBCEE32AF3CEB292507F3900
                                                                                        SHA1:3BFEBE89DC2FB8665E1AFA8F16FB46E01408F2A7
                                                                                        SHA-256:631214E4BC32B3AF953B4FA942FABA307421AF1D8C24BCBE673465D33D9AEFA6
                                                                                        SHA-512:FA99B4F664CDAA85D1DBD241DC5FA58D6EE452C0D72890343FD62017B4CF39340E8E781F63ECB255F04574EBE772B1E89A27AF61BC199D63BC2B00AC1B8E0AA4
                                                                                        Malicious:false
                                                                                        Preview:......Exif..MM.*.......................................................................................................(...........1...........2..........i............. ............'.......'.Adobe Photoshop CC (Windows).2018:04:10 09:26:56..............0221..................................................................n...........v.(.....................~...........S.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................3...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....l.....<..:......rU..5_....R..S.N..l..5...W.6....RI.1....F..[..zu..g....
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):248
                                                                                        Entropy (8bit):5.319965928228987
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWPUWa1ZDVg7n9MGYDKMthF0ZDDL77UFZDVg7/EKUHWAfJExHpinGTjeOPy:HnPkC6bGvLYZC/6Xf+wCCOPy
                                                                                        MD5:98341D30827494250CC2A71E33820C40
                                                                                        SHA1:F48469D0BED2E38B0676A15ADEA444F22247F0D8
                                                                                        SHA-256:BCEC5841DE2068DC252F5B8D9C4BC647E990DF4793FEF74F19AA3ECB3714A789
                                                                                        SHA-512:DC464FC6ED0D1E43EF81332BBCA2360D9DC804E4D133CB9B728915571EF5565CE76155C4CB584EA0884FF1B5DC69E701C4F26E499B050413FD81B78CC6E0761B
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=reset_warn_mask.bmp..Normal=Click_Warn_normal.jpg..Over=Click_Warn_over.jpg..Down=Click_Warn_down.jpg..Disable=Click_Warn_normal.jpg....[BUTTONPOS]..1=BUTTON_OK,288,111,81,23,..2=BUTTON_CANCEL,376,111,81,23,..3=BUTTON_EXIT,0,0,0,0,..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):247
                                                                                        Entropy (8bit):5.318374125358607
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWRQV1ZDVg7n9MGYDKMthF0ZDDL77UFZDVg7/EKUHWAfJExHpinGTjeOPn:HJQ9C6bGvLYZC/6Xf+wCCOPn
                                                                                        MD5:F3312B2BE992155ACD0D9ACA5CCC8C6C
                                                                                        SHA1:6CFB8E2F8D99075572E909A0CE65C54671DA2591
                                                                                        SHA-256:30196402442A573DE2E3E0B13F8C8AC5248CB02CF8461E3D002231604B3A3404
                                                                                        SHA-512:1512DB3B7BD08E19D709DAB042C86DAB9AFCD8B779A07800BF79B57153E25CA90DB6920631C16747CCB208202A1563BE3FD1FDC17727C3090D2191A92AC31D14
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=small_popup_mask.bmp..Normal=Click_Warn_normal.jpg..Over=Click_Warn_over.jpg..Down=Click_Warn_down.jpg..Disable=Click_Warn_normal.jpg....[BUTTONPOS]..1=BUTTON_OK,288,111,81,23,..2=BUTTON_CANCEL,376,111,81,23,..3=BUTTON_EXIT,0,0,0,0,
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):579
                                                                                        Entropy (8bit):5.222030511989475
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:HhcvjkSYtjGErkS/6HAJMnPBfpppDQrRn+Uhu/tfglEb4CKKEJz0lCnUWWgc:6vISHSiguphDD6RnD4gl24CKKNCnUd
                                                                                        MD5:EB138B07D393C4A13F42F37127B3315D
                                                                                        SHA1:E868B8BD51E32A05F17A61BD763EEB3A264AC0D5
                                                                                        SHA-256:7FF3A111CE9F0FEA692D817160B17E827E37C7441B19FCBB6BC945510FDC0C11
                                                                                        SHA-512:E8C474D8BD0C8883E9D2DF59EC56FDC7559C91628214B5AB1187F5EF97185E85BE5693063F89FF2C65927C2691607377D68A5D81906361D308E95FA2DBE60735
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=macro_manager_mask.bmp..Normal=macro_manager_normal.jpg..Over=macro_manager_over.jpg..Down=macro_manager_down.jpg..Disable=macro_manager_normal.jpg....[BUTTONPOS]..1=OK,226,298,43,20,..2=Cancel,282,298,43,20,..3=Exit,0,0,0,0,..4=BUTTON_New,8,298,43,20,..5=BUTTON_Delete,62,298,43,20,..6=BUTTON_List_MacroName,11,40,101,241,..7=BUTTON_Start_Record,232,47,91,21,....8=BUTTON_Delay_ON_OFF,231,79,15,15,..9=BUTTON_LoopTimes_ON_OFF,232,214,15,15,..10=Edit_Times,255,234,64,19,..11=BUTTON_List_key_sequence,119,40,101,241,..12=LOAD,115,298,43,20,..13=SAVE,171,298,43,20,
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):247
                                                                                        Entropy (8bit):5.318374125358607
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWRQV1ZDVg7n9MGYDKMthF0ZDDL77UFZDVg7/EKUHWAfJExHpinGTjeOPn:HJQ9C6bGvLYZC/6Xf+wCCOPn
                                                                                        MD5:F3312B2BE992155ACD0D9ACA5CCC8C6C
                                                                                        SHA1:6CFB8E2F8D99075572E909A0CE65C54671DA2591
                                                                                        SHA-256:30196402442A573DE2E3E0B13F8C8AC5248CB02CF8461E3D002231604B3A3404
                                                                                        SHA-512:1512DB3B7BD08E19D709DAB042C86DAB9AFCD8B779A07800BF79B57153E25CA90DB6920631C16747CCB208202A1563BE3FD1FDC17727C3090D2191A92AC31D14
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=small_popup_mask.bmp..Normal=Click_Warn_normal.jpg..Over=Click_Warn_over.jpg..Down=Click_Warn_down.jpg..Disable=Click_Warn_normal.jpg....[BUTTONPOS]..1=BUTTON_OK,288,111,81,23,..2=BUTTON_CANCEL,376,111,81,23,..3=BUTTON_EXIT,0,0,0,0,
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):1555
                                                                                        Entropy (8bit):4.803906701986935
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:1SXvO8Y3viLGpJQu1TNRFLFKumF3NSqMJqpksL1Dcw2NJaU9h2/I8tJ:8EiA1tgum9NNMJ+k6VqJaKStJ
                                                                                        MD5:F6339D59DB697930227C8A7F618938C2
                                                                                        SHA1:C1C7B716C0738B864C9293A6AF7D191531AC5E17
                                                                                        SHA-256:89510A169E045F77164D2D2AF41CC4AC9CFAF17FC81552927AE4B654D117F6CD
                                                                                        SHA-512:2B265F8EB77C6F4B83579FF539E6E6914B81B574444EC5F828F90FA65B07393E336598926C741C9FB1F2AEDBE82663453639CB77808E5DA229A9B548CCE87F9F
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=config_mask.bmp..Normal=config_normal.jpg..Over=config_over.jpg..Down=config_down.jpg..Disable=config_normal.jpg....[BUTTONPOS]..1=Create,0,0,0,0,,..2=Load,0,0,0,0,,..3=Save,0,0,0,0,,..4=Edit,0,0,0,0,,....5=Profile 1,0,0,0,0,,..6=Profile 2,0,0,0,0,,..7=Profile 3,0,0,0,0,,..8=Profile 4,0,0,0,0,,..9=Profile 5,0,0,0,0,,....10=Min,564,9,26,17,,..11=Exit,595,9,34,17,,..12=OK,0,0,0,0,,..13=Cancel,530,442,88,21,,..14=Apply,430,442,88,21,,......15=Profile 1 name,0,0,0,0,,..16=Profile 2 name,0,0,0,0,,..17=Profile 3 name,0,0,0,0,,..18=Profile 4 name,0,0,0,0,,..19=Profile 5 name,0,0,0,0,,......20=Click,13,56,164,25,..21=Menu,13,91,164,25,..22=Middle,13,125,164,25,..23=Backwrd,13,195,164,25,..24=FORWARD,13,160,164,25,..25=Cpi,0,0,0,0,..26=Encode1,0,0,0,0,..27=Encode2,0,0,0,0,..28=Backwrd,0,0,0,0,..29=Backwrd,0,0,0,0,..30=Backwrd,0,0,0,0,..31=Backwrd,0,0,0,0,..32=Backwrd,0,0,0,0,..33=Backwrd,13,228,164,28,..34=Backwrd,13,263,164,28,....35=Right hand,0,0,0,0,..36=Left hand,0,0,0,0,...
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):248
                                                                                        Entropy (8bit):5.319965928228987
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWPUWa1ZDVg7n9MGYDKMthF0ZDDL77UFZDVg7/EKUHWAfJExHpinGTjeOPy:HnPkC6bGvLYZC/6Xf+wCCOPy
                                                                                        MD5:98341D30827494250CC2A71E33820C40
                                                                                        SHA1:F48469D0BED2E38B0676A15ADEA444F22247F0D8
                                                                                        SHA-256:BCEC5841DE2068DC252F5B8D9C4BC647E990DF4793FEF74F19AA3ECB3714A789
                                                                                        SHA-512:DC464FC6ED0D1E43EF81332BBCA2360D9DC804E4D133CB9B728915571EF5565CE76155C4CB584EA0884FF1B5DC69E701C4F26E499B050413FD81B78CC6E0761B
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=reset_warn_mask.bmp..Normal=Click_Warn_normal.jpg..Over=Click_Warn_over.jpg..Down=Click_Warn_down.jpg..Disable=Click_Warn_normal.jpg....[BUTTONPOS]..1=BUTTON_OK,288,111,81,23,..2=BUTTON_CANCEL,376,111,81,23,..3=BUTTON_EXIT,0,0,0,0,..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):425
                                                                                        Entropy (8bit):5.360238719922821
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWPUWaig7no8hP77Ue5Fg7/EKUHNInlAfJEYinGTjbPOPJCCdFYMEOWnLYWSQ3:HnPG0G12/6Wnif4C/POPJfYwWL5SQ3
                                                                                        MD5:3D34E18140DF4C3B68E6A6483ED3B0F8
                                                                                        SHA1:45DF7799B1DCBAF74B938BE11E87D7D90E8C1102
                                                                                        SHA-256:D7967E2DE8A962AC1FDF46E5FB445E817222FCFA4A199CC555FDEF0EEBA96154
                                                                                        SHA-512:AB077AC7BB29B69D5906F5ECCFE16B463B3F239EF283FC9686544009B909C9EA567887EA999CF91DA6966D6D3CD918FAF419C1F828DF39682BCA6DDD1B625306
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=reset_warn_mask.bmp..Normal=key_shortcut_normal.jpg..Over=key_shortcut_over.jpg..Down=key_shortcut_down.jpg..Disable=key_shortcut_normal.jpg....[BUTTONPOS]..1=EDIT_MACRO_SET_NAME,0,0,0,0,..2=BUTTON_OK,288,111,81,23,..3=BUTTON_CANCEL,376,111,81,23,..4=BUTTON_EXIT,0,0,0,0,..5=None,87,38,20,20,..6=Ctrl,173,38,20,20,..7=Shift,259,38,20,20,..8=Alt,344,38,20,20,..9=Win+,87,72,20,20,..10=Single Key,152,75,71,18,..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:Generic INItialization configuration [BUTTONPOS]
                                                                                        Category:dropped
                                                                                        Size (bytes):395
                                                                                        Entropy (8bit):5.2156498794041575
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:77EWPUWa/jn7nTR5hcu7UGCn7/EKUHNInlAfJEYinGTjbPOPJQM5Uvovn:HnPknShn/6Wnif4C/POPJQy0y
                                                                                        MD5:ECF65DEB1E35AE528BB4C428AA9A7DE6
                                                                                        SHA1:902A6BFD932AD76E8BF97D74E1B7700730C8929C
                                                                                        SHA-256:E831225EB545E7BBE1DA93C94CC7BAF9FA77FDB5BC7F288B147DC5192F96EB26
                                                                                        SHA-512:A89823BC49DD80B37D998565102082FBDAD8167B327D4E743CD7DB3099F94FB0ADC5468BAEDEFD3EA550E7011522F9DF0B5A43BB383FBE9480A2507884A82380
                                                                                        Malicious:false
                                                                                        Preview:[SCREEN]..Mask=reset_warn_mask.bmp..Normal=single_key_normal.jpg..Over=single_key_over.jpg..Down=single_key_down.jpg..Disable=single_key_normal.jpg....[BUTTONPOS]..1=EDIT_MACRO_SET_NAME,0,0,0,0,..2=BUTTON_OK,288,111,81,23,..3=BUTTON_CANCEL,376,111,81,23,..4=BUTTON_EXIT,0,0,0,0,..5=None,0,0,0,0,..6=Ctrl,0,0,0,0,..7=Shift,0,0,0,0,..8=Alt,0,0,0,0,..9=Win+,0,0,0,0,..10=Single Key,127,57,210,24,..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PC bitmap, Windows 3.x format, 475 x 150 x 24, image size 214200, cbSize 214254, bits offset 54
                                                                                        Category:dropped
                                                                                        Size (bytes):214254
                                                                                        Entropy (8bit):0.0013128067959919045
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:RlQklRaFlG:DQsRafG
                                                                                        MD5:05A046EFC14725DEDA982EA9044857FB
                                                                                        SHA1:FD115023F4D5F76393398E13EC2E5062C1B13286
                                                                                        SHA-256:16088313FFDD2C105D0A629BAFF7B7CA25A6EE05A4897FA5B4AE589F01EF9A04
                                                                                        SHA-512:1D7CEB88B0D6FA4EB3399C25D4A370DC0F4DBEF2626BA51B762BF2D421A331049C792C85FED44D340993DAAAC6BC225F8C0DBB57E7CE987635AD041F04B13597
                                                                                        Malicious:false
                                                                                        Preview:BM.D......6...(....................D....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:InnoSetup Log MOUSE DRIVER V628M {865865F2-6748-4710-99DC-5248204D8FD4}, version 0x418, 15914 bytes, 888683\37\user\376, C:\Users\user\AppData\Roaming\MOUSE DRIVE
                                                                                        Category:dropped
                                                                                        Size (bytes):15914
                                                                                        Entropy (8bit):3.840638587912821
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:e27XScmY/ywL5bP4D1mmxH9FYNpsvMsApyxNQBeBv+Mj9U3+/d3rmfDOBlsl3LyN:eEXPmY/yq5bPDNAjKHM
                                                                                        MD5:8306646167200D1FDCED1E6F22BB312C
                                                                                        SHA1:8276D4FFB6482E64CB30210FFB9B010252B09D5F
                                                                                        SHA-256:58F65BEC20982E72617FAB9E4A7F99228484C00B9F94ED4A794B260B0B0498B6
                                                                                        SHA-512:3D226D7AEB58C7148366ECDA9DFB6E2FA1FD49DBB8D27B20F6A9742409B6C646815631098AFDFAACCDAFB82D8379FCEB0F7DDE689A8E89A561C981FD38F0CB2B
                                                                                        Malicious:false
                                                                                        Preview:Inno Setup Uninstall Log (b)....................................{865865F2-6748-4710-99DC-5248204D8FD4}..........................................................................................MOUSE DRIVER V628M..................................................................................................................D...*>..%................................................................................................................& 3.........\.*...............8.8.8.6.8.3......j.o.n.e.s......C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.O.U.S.E. .D.R.I.V.E.R. .V.6.2.8.M....................e.. ..........@...IFPS....!...............................................................................................................................................................BOOLEAN..........................TFILETIME.................................................TFINDREC.........TUNINSTALLSTEP.........TEXECWAIT.................!MAIN....-1.............PDIR....1
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1654643
                                                                                        Entropy (8bit):5.765146909055034
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:9tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5DqixYVTx9VD:zqTytRFk6ek1DGL
                                                                                        MD5:052729768EF5BE0F98FA7A8E39880B49
                                                                                        SHA1:1912862FD845FD7E01B8005B7D968E1318F6B16B
                                                                                        SHA-256:5F873CEE08F0EEF35B8B83F04E0C80058105C2EAD121365E439AF305A61CC2CF
                                                                                        SHA-512:511BBBDB962ABD052A8A27BB35B32E71A3D0F63E5183888FE6E481CD785C3538B6B24EE5303403BB5B3E5B554919B9A4ACF43C6D68559EAB65C0FCCE630508D9
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 5%
                                                                                        Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0...x................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....x...0...z...l..............@..@....................................@..@........................................................................................................................................
                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Entropy (8bit):7.072425905752755
                                                                                        TrID:
                                                                                        • Win32 Executable (generic) a (10002005/4) 99.94%
                                                                                        • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                        File name:MOUSE DRIVER V628M Setup.exe
                                                                                        File size:1'636'941 bytes
                                                                                        MD5:5e4878a6c4aa83627e213da27011d658
                                                                                        SHA1:4cd633b7247089b345dc6eef1fd0907ab58df3df
                                                                                        SHA256:9368f50ee12f0d78b86dd9bb3bb1a0e0647d90094834b725d318af696e58fa04
                                                                                        SHA512:212bbcfafb8918e701e8b4ebafd80e7d4449cc1c3ba947e50ee61f7d26076228422ed6fadebe2946ac8bf6bee4262e47d02bf2b6c8db5d46252828bf77a57013
                                                                                        SSDEEP:24576:fBWJqixY8VzktjDgQyRcPnTOFenpUuQVBn1AR9a2Spy:oJlzkVDgePCoUuQ7ya2Sy
                                                                                        TLSH:02759BD2E3DE84B4E465757588338C779E376C7C2CE0100A2DADF67EAFB52924476A02
                                                                                        File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................
                                                                                        Icon Hash:1e1812233557abe1
                                                                                        Entrypoint:0x4117dc
                                                                                        Entrypoint Section:.itext
                                                                                        Digitally signed:false
                                                                                        Imagebase:0x400000
                                                                                        Subsystem:windows gui
                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                        Time Stamp:0x57051F88 [Wed Apr 6 14:39:04 2016 UTC]
                                                                                        TLS Callbacks:
                                                                                        CLR (.Net) Version:
                                                                                        OS Version Major:5
                                                                                        OS Version Minor:0
                                                                                        File Version Major:5
                                                                                        File Version Minor:0
                                                                                        Subsystem Version Major:5
                                                                                        Subsystem Version Minor:0
                                                                                        Import Hash:20dd26497880c05caed9305b3c8b9109
                                                                                        Instruction
                                                                                        push ebp
                                                                                        mov ebp, esp
                                                                                        add esp, FFFFFFA4h
                                                                                        push ebx
                                                                                        push esi
                                                                                        push edi
                                                                                        xor eax, eax
                                                                                        mov dword ptr [ebp-3Ch], eax
                                                                                        mov dword ptr [ebp-40h], eax
                                                                                        mov dword ptr [ebp-5Ch], eax
                                                                                        mov dword ptr [ebp-30h], eax
                                                                                        mov dword ptr [ebp-38h], eax
                                                                                        mov dword ptr [ebp-34h], eax
                                                                                        mov dword ptr [ebp-2Ch], eax
                                                                                        mov dword ptr [ebp-28h], eax
                                                                                        mov dword ptr [ebp-14h], eax
                                                                                        mov eax, 00410144h
                                                                                        call 00007F6978B1D64Dh
                                                                                        xor eax, eax
                                                                                        push ebp
                                                                                        push 00411EBEh
                                                                                        push dword ptr fs:[eax]
                                                                                        mov dword ptr fs:[eax], esp
                                                                                        xor edx, edx
                                                                                        push ebp
                                                                                        push 00411E7Ah
                                                                                        push dword ptr fs:[edx]
                                                                                        mov dword ptr fs:[edx], esp
                                                                                        mov eax, dword ptr [00415B48h]
                                                                                        call 00007F6978B25D93h
                                                                                        call 00007F6978B258E2h
                                                                                        cmp byte ptr [00412ADCh], 00000000h
                                                                                        je 00007F6978B2888Eh
                                                                                        call 00007F6978B25EA8h
                                                                                        xor eax, eax
                                                                                        call 00007F6978B1B6E5h
                                                                                        lea edx, dword ptr [ebp-14h]
                                                                                        xor eax, eax
                                                                                        call 00007F6978B2292Bh
                                                                                        mov edx, dword ptr [ebp-14h]
                                                                                        mov eax, 00418658h
                                                                                        call 00007F6978B1BCBAh
                                                                                        push 00000002h
                                                                                        push 00000000h
                                                                                        push 00000001h
                                                                                        mov ecx, dword ptr [00418658h]
                                                                                        mov dl, 01h
                                                                                        mov eax, dword ptr [0040C04Ch]
                                                                                        call 00007F6978B23242h
                                                                                        mov dword ptr [0041865Ch], eax
                                                                                        xor edx, edx
                                                                                        push ebp
                                                                                        push 00411E26h
                                                                                        push dword ptr fs:[edx]
                                                                                        mov dword ptr fs:[edx], esp
                                                                                        call 00007F6978B25E06h
                                                                                        mov dword ptr [00418664h], eax
                                                                                        mov eax, dword ptr [00418664h]
                                                                                        cmp dword ptr [eax+0Ch], 01h
                                                                                        jne 00007F6978B288CAh
                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x190000xe04.idata
                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x1c0000x795e4.rsrc
                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x1b0000x18.rdata
                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x193040x214.idata
                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                        .text0x10000xf2440xf400a33e9ff7181115027d121cd377c28c8fFalse0.5481717469262295data6.3752135040515485IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                        .itext0x110000xf640x1000caec456c18277b579a94c9508daf36ecFalse0.55859375data5.732200666157372IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                        .data0x120000xc880xe00746954890499546d73dce0e994642192False0.2533482142857143data2.2967209087898324IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        .bss0x130000x56bc0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        .idata0x190000xe040x1000e9b9c0328fd9628ad4d6ab8283dcb20eFalse0.321533203125data4.597812557707959IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        .tls0x1a0000x80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        .rdata0x1b0000x180x2003dffc444ccc131c9dcee18db49ee6403False0.05078125data0.2044881574398449IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                        .rsrc0x1c0000x795e40x79600029c3924372bf67b051a2151307c8a91False0.1594321253861998data3.395657528646198IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                        RT_ICON0x1c50c0x42028Device independent bitmap graphic, 256 x 512 x 32, image size 270336EnglishUnited States0.13227875255200167
                                                                                        RT_ICON0x5e5340x10828Device independent bitmap graphic, 128 x 256 x 32, image size 67584EnglishUnited States0.1681059978705785
                                                                                        RT_ICON0x6ed5c0x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 38016EnglishUnited States0.19823418120664285
                                                                                        RT_ICON0x782040x67e8Device independent bitmap graphic, 80 x 160 x 32, image size 26560EnglishUnited States0.20597744360902256
                                                                                        RT_ICON0x7e9ec0x5488Device independent bitmap graphic, 72 x 144 x 32, image size 21600EnglishUnited States0.22264325323475045
                                                                                        RT_ICON0x83e740x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.2220713273500236
                                                                                        RT_ICON0x8809c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.26358921161825727
                                                                                        RT_ICON0x8a6440x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.3222326454033771
                                                                                        RT_ICON0x8b6ec0x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.5106382978723404
                                                                                        RT_STRING0x8bb540x68data0.6538461538461539
                                                                                        RT_STRING0x8bbbc0xd4data0.5283018867924528
                                                                                        RT_STRING0x8bc900xa4data0.6524390243902439
                                                                                        RT_STRING0x8bd340x2acdata0.45614035087719296
                                                                                        RT_STRING0x8bfe00x34cdata0.4218009478672986
                                                                                        RT_STRING0x8c32c0x294data0.4106060606060606
                                                                                        RT_RCDATA0x8c5c00x82e8dataEnglishUnited States0.11261637622344235
                                                                                        RT_RCDATA0x948a80x10data1.5
                                                                                        RT_RCDATA0x948b80x150data0.8392857142857143
                                                                                        RT_RCDATA0x94a080x2cdata1.1590909090909092
                                                                                        RT_GROUP_ICON0x94a340x84dataEnglishUnited States0.7272727272727273
                                                                                        RT_VERSION0x94ab80x4f4dataEnglishUnited States0.2697160883280757
                                                                                        RT_MANIFEST0x94fac0x637XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.4248900062853551
                                                                                        DLLImport
                                                                                        oleaut32.dllSysFreeString, SysReAllocStringLen, SysAllocStringLen
                                                                                        advapi32.dllRegQueryValueExW, RegOpenKeyExW, RegCloseKey
                                                                                        user32.dllGetKeyboardType, LoadStringW, MessageBoxA, CharNextW
                                                                                        kernel32.dllGetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
                                                                                        kernel32.dllTlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
                                                                                        user32.dllCreateWindowExW, TranslateMessage, SetWindowLongW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, ExitWindowsEx, DispatchMessageW, DestroyWindow, CharUpperBuffW, CallWindowProcW
                                                                                        kernel32.dllWriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SizeofResource, SignalObjectAndWait, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, MultiByteToWideChar, LockResource, LoadResource, LoadLibraryW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetThreadLocale, GetSystemInfo, GetSystemDirectoryW, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetDiskFreeSpaceW, GetCurrentProcess, GetCommandLineW, GetCPInfo, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, EnumCalendarInfoW, DeleteFileW, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CloseHandle
                                                                                        advapi32.dllRegQueryValueExW, RegOpenKeyExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW
                                                                                        comctl32.dllInitCommonControls
                                                                                        kernel32.dllSleep
                                                                                        advapi32.dllAdjustTokenPrivileges
                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                        EnglishUnited States
                                                                                        No network behavior found

                                                                                        Click to jump to process

                                                                                        Click to jump to process

                                                                                        Click to dive into process behavior distribution

                                                                                        Click to jump to process

                                                                                        Target ID:0
                                                                                        Start time:07:19:54
                                                                                        Start date:20/11/2024
                                                                                        Path:C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe"
                                                                                        Imagebase:0x400000
                                                                                        File size:1'636'941 bytes
                                                                                        MD5 hash:5E4878A6C4AA83627E213DA27011D658
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:Borland Delphi
                                                                                        Reputation:low
                                                                                        Has exited:true

                                                                                        Target ID:1
                                                                                        Start time:07:19:54
                                                                                        Start date:20/11/2024
                                                                                        Path:C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\is-4D2H9.tmp\MOUSE DRIVER V628M Setup.tmp" /SL5="$10472,1195863,572928,C:\Users\user\Desktop\MOUSE DRIVER V628M Setup.exe"
                                                                                        Imagebase:0x400000
                                                                                        File size:1'631'744 bytes
                                                                                        MD5 hash:6CA87850DD6B5C077CAC15F6D33189D7
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:Borland Delphi
                                                                                        Antivirus matches:
                                                                                        • Detection: 5%, ReversingLabs
                                                                                        Reputation:low
                                                                                        Has exited:true

                                                                                        Target ID:3
                                                                                        Start time:07:20:03
                                                                                        Start date:20/11/2024
                                                                                        Path:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Monitor.exe" 1
                                                                                        Imagebase:0x400000
                                                                                        File size:614'400 bytes
                                                                                        MD5 hash:C0C6BDC385DEB10654C7558831EEFA03
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low
                                                                                        Has exited:false

                                                                                        Target ID:5
                                                                                        Start time:07:20:11
                                                                                        Start date:20/11/2024
                                                                                        Path:C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\Option.exe"
                                                                                        Imagebase:0x400000
                                                                                        File size:1'007'616 bytes
                                                                                        MD5 hash:705A431F29F577E556CE3E22DDDC737C
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low
                                                                                        Has exited:false

                                                                                        Reset < >

                                                                                          Execution Graph

                                                                                          Execution Coverage:10.8%
                                                                                          Dynamic/Decrypted Code Coverage:14.3%
                                                                                          Signature Coverage:5%
                                                                                          Total number of Nodes:2000
                                                                                          Total number of Limit Nodes:33
                                                                                          execution_graph 16080 21b159b 16082 21b15b7 16080->16082 16084 21b15ae 16080->16084 16082->16084 16087 21b15df 16082->16087 16088 21b14c2 16082->16088 16083 21b15ff 16086 21b14c2 83 API calls 16083->16086 16083->16087 16084->16083 16085 21b14c2 83 API calls 16084->16085 16084->16087 16085->16083 16086->16087 16089 21b14cf GetVersion 16088->16089 16090 21b1557 16088->16090 16117 21b287f HeapCreate 16089->16117 16092 21b1589 16090->16092 16093 21b155d 16090->16093 16099 21b1522 16092->16099 16211 21b2197 16092->16211 16094 21b1578 16093->16094 16093->16099 16198 21b1fcb 16093->16198 16201 21b23f3 16094->16201 16096 21b14e1 16096->16099 16124 21b20ab 16096->16124 16099->16084 16102 21b1519 16104 21b151d 16102->16104 16105 21b1526 GetCommandLineA 16102->16105 16134 21b28bb 16104->16134 16139 21b274d 16105->16139 16110 21b28bb 5 API calls 16110->16099 16112 21b1540 16176 21b2500 16112->16176 16114 21b1545 16185 21b2447 16114->16185 16116 21b154a 16116->16099 16118 21b289f 16117->16118 16119 21b28b4 16117->16119 16233 21b3c25 HeapAlloc 16118->16233 16119->16096 16122 21b28a8 HeapDestroy 16122->16119 16123 21b28b7 16123->16096 16235 21b3185 InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 16124->16235 16126 21b20b1 TlsAlloc 16127 21b20fb 16126->16127 16128 21b20c1 16126->16128 16127->16102 16236 21b3290 16128->16236 16130 21b20ca 16130->16127 16131 21b20d2 TlsSetValue 16130->16131 16131->16127 16132 21b20e3 16131->16132 16133 21b20e9 GetCurrentThreadId 16132->16133 16133->16102 16135 21b28cd 16134->16135 16136 21b2911 HeapFree HeapDestroy 16134->16136 16137 21b28dd VirtualFree VirtualFree HeapFree 16135->16137 16136->16099 16137->16137 16138 21b290f 16137->16138 16138->16136 16140 21b279b 16139->16140 16141 21b2768 GetEnvironmentStringsW 16139->16141 16143 21b2770 16140->16143 16144 21b278c 16140->16144 16142 21b277c GetEnvironmentStrings 16141->16142 16141->16143 16142->16144 16145 21b1536 16142->16145 16146 21b27a8 GetEnvironmentStringsW 16143->16146 16147 21b27b4 WideCharToMultiByte 16143->16147 16144->16145 16148 21b283a 16144->16148 16149 21b282e GetEnvironmentStrings 16144->16149 16162 21b2237 16145->16162 16146->16145 16146->16147 16151 21b281a FreeEnvironmentStringsW 16147->16151 16152 21b27e8 16147->16152 16153 21b3365 20 API calls 16148->16153 16149->16145 16149->16148 16151->16145 16154 21b3365 20 API calls 16152->16154 16160 21b2855 16153->16160 16155 21b27ee 16154->16155 16155->16151 16156 21b27f7 WideCharToMultiByte 16155->16156 16158 21b2808 16156->16158 16159 21b2811 16156->16159 16157 21b286b FreeEnvironmentStringsA 16157->16145 16161 21b331d 20 API calls 16158->16161 16159->16151 16160->16157 16161->16159 16163 21b3365 20 API calls 16162->16163 16164 21b224a 16163->16164 16165 21b2258 GetStartupInfoA 16164->16165 16166 21b1638 7 API calls 16164->16166 16173 21b22a6 16165->16173 16174 21b2377 16165->16174 16166->16165 16168 21b23e2 SetHandleCount 16168->16112 16169 21b23a2 GetStdHandle 16171 21b23b0 GetFileType 16169->16171 16169->16174 16170 21b3365 20 API calls 16170->16173 16171->16174 16172 21b231d 16172->16174 16175 21b233f GetFileType 16172->16175 16173->16170 16173->16172 16173->16174 16174->16168 16174->16169 16175->16172 16177 21b2512 16176->16177 16178 21b2517 GetModuleFileNameA 16176->16178 16344 21b38c8 16177->16344 16180 21b253a 16178->16180 16181 21b3365 20 API calls 16180->16181 16182 21b255b 16181->16182 16183 21b256b 16182->16183 16184 21b1638 7 API calls 16182->16184 16183->16114 16184->16183 16186 21b2454 16185->16186 16188 21b2459 16185->16188 16187 21b38c8 39 API calls 16186->16187 16187->16188 16189 21b3365 20 API calls 16188->16189 16190 21b2486 16189->16190 16191 21b1638 7 API calls 16190->16191 16192 21b249a 16190->16192 16191->16192 16195 21b3365 20 API calls 16192->16195 16196 21b24dd 16192->16196 16197 21b1638 7 API calls 16192->16197 16193 21b331d 20 API calls 16194 21b24e9 16193->16194 16194->16116 16195->16192 16196->16193 16197->16192 16403 21b1fda 16198->16403 16203 21b23fb 16201->16203 16202 21b157d 16206 21b20ff 16202->16206 16203->16202 16204 21b331d 20 API calls 16203->16204 16205 21b2415 DeleteCriticalSection 16203->16205 16204->16203 16205->16203 16419 21b31ae 16206->16419 16208 21b2104 16209 21b210e TlsFree 16208->16209 16210 21b1582 16208->16210 16209->16210 16210->16110 16212 21b2236 16211->16212 16213 21b21a5 16211->16213 16212->16099 16214 21b21ae TlsGetValue 16213->16214 16217 21b21bb 16213->16217 16215 21b2227 TlsSetValue 16214->16215 16214->16217 16215->16212 16216 21b21c8 16219 21b21d6 16216->16219 16220 21b331d 20 API calls 16216->16220 16217->16216 16218 21b331d 20 API calls 16217->16218 16218->16216 16221 21b21e4 16219->16221 16223 21b331d 20 API calls 16219->16223 16220->16219 16222 21b21f2 16221->16222 16224 21b331d 20 API calls 16221->16224 16225 21b2200 16222->16225 16226 21b331d 20 API calls 16222->16226 16223->16221 16224->16222 16227 21b220e 16225->16227 16228 21b331d 20 API calls 16225->16228 16226->16225 16229 21b221f 16227->16229 16231 21b331d 20 API calls 16227->16231 16228->16227 16230 21b331d 20 API calls 16229->16230 16232 21b2226 16230->16232 16231->16229 16232->16215 16234 21b28a4 16233->16234 16234->16122 16234->16123 16235->16126 16237 21b32a3 16236->16237 16238 21b32dc HeapAlloc 16237->16238 16242 21b3307 16237->16242 16243 21b321a 16237->16243 16258 21b3fb9 16237->16258 16266 21b327b LeaveCriticalSection 16237->16266 16238->16237 16238->16242 16242->16130 16244 21b3232 16243->16244 16245 21b3270 EnterCriticalSection 16243->16245 16267 21b3365 16244->16267 16245->16237 16248 21b3248 16250 21b321a 18 API calls 16248->16250 16251 21b3250 16250->16251 16252 21b3261 16251->16252 16253 21b3257 InitializeCriticalSection 16251->16253 16276 21b331d 16252->16276 16254 21b3266 16253->16254 16289 21b327b LeaveCriticalSection 16254->16289 16257 21b326e 16257->16245 16262 21b3feb 16258->16262 16259 21b4093 16340 21b4373 16259->16340 16262->16259 16264 21b40a7 16262->16264 16333 21b42c2 16262->16333 16264->16237 16266->16237 16290 21b3377 16267->16290 16270 21b1638 16271 21b1642 16270->16271 16272 21b1654 16271->16272 16305 21b2930 16271->16305 16311 21b2969 16272->16311 16277 21b3363 16276->16277 16278 21b3326 16276->16278 16277->16254 16279 21b321a 19 API calls 16278->16279 16280 21b332d 16279->16280 16281 21b3339 16280->16281 16282 21b334c 16280->16282 16325 21b3c8e 16281->16325 16332 21b327b LeaveCriticalSection 16282->16332 16285 21b3340 16331 21b327b LeaveCriticalSection 16285->16331 16286 21b3353 HeapFree 16286->16277 16288 21b3347 16288->16254 16289->16257 16291 21b323a 16290->16291 16293 21b337e 16290->16293 16291->16248 16291->16270 16293->16291 16294 21b33a3 16293->16294 16295 21b33c7 16294->16295 16296 21b33b1 16294->16296 16297 21b33d9 HeapAlloc 16295->16297 16299 21b33ce 16295->16299 16298 21b321a 19 API calls 16296->16298 16297->16299 16300 21b33b8 16298->16300 16299->16293 16301 21b3fb9 5 API calls 16300->16301 16302 21b33be 16301->16302 16304 21b327b LeaveCriticalSection 16302->16304 16304->16295 16306 21b293a 16305->16306 16307 21b2967 16306->16307 16308 21b2969 7 API calls 16306->16308 16307->16272 16309 21b2951 16308->16309 16310 21b2969 7 API calls 16309->16310 16310->16307 16313 21b297c 16311->16313 16312 21b165d 16312->16248 16313->16312 16314 21b2a93 16313->16314 16315 21b29bc 16313->16315 16316 21b2aa6 GetStdHandle WriteFile 16314->16316 16315->16312 16317 21b29c8 GetModuleFileNameA 16315->16317 16316->16312 16318 21b29e0 16317->16318 16320 21b446e 16318->16320 16321 21b447b LoadLibraryA 16320->16321 16323 21b44bd 16320->16323 16322 21b448c GetProcAddress 16321->16322 16321->16323 16322->16323 16324 21b44a3 GetProcAddress GetProcAddress 16322->16324 16323->16312 16324->16323 16327 21b3cd5 16325->16327 16326 21b3ec7 VirtualFree 16328 21b3f2b 16326->16328 16327->16326 16330 21b3f81 16327->16330 16329 21b3f3a VirtualFree HeapFree 16328->16329 16328->16330 16329->16330 16330->16285 16331->16288 16332->16286 16334 21b4305 HeapAlloc 16333->16334 16335 21b42d5 HeapReAlloc 16333->16335 16336 21b432b VirtualAlloc 16334->16336 16337 21b408a 16334->16337 16335->16337 16338 21b42f4 16335->16338 16336->16337 16339 21b4345 HeapFree 16336->16339 16337->16259 16337->16264 16338->16334 16339->16337 16341 21b4385 VirtualAlloc 16340->16341 16343 21b4099 16341->16343 16343->16264 16345 21b38d8 16344->16345 16346 21b38d1 16344->16346 16345->16178 16348 21b34f0 16346->16348 16349 21b321a 20 API calls 16348->16349 16350 21b3500 16349->16350 16359 21b369d 16350->16359 16352 21b3517 16372 21b327b LeaveCriticalSection 16352->16372 16355 21b3695 16355->16345 16357 21b353c GetCPInfo 16358 21b3552 16357->16358 16358->16352 16364 21b3743 GetCPInfo 16358->16364 16360 21b36bd 16359->16360 16361 21b36ad GetOEMCP 16359->16361 16362 21b3508 16360->16362 16363 21b36c2 GetACP 16360->16363 16361->16360 16362->16352 16362->16357 16362->16358 16363->16362 16365 21b382e 16364->16365 16367 21b3766 16364->16367 16365->16352 16373 21b4c52 16367->16373 16371 21b4a03 9 API calls 16371->16365 16372->16355 16374 21b4c83 GetStringTypeW 16373->16374 16378 21b4c9b 16373->16378 16375 21b4c9f GetStringTypeA 16374->16375 16374->16378 16375->16378 16379 21b37e2 16375->16379 16376 21b4cea 16376->16379 16381 21b4d00 MultiByteToWideChar 16376->16381 16377 21b4cc6 GetStringTypeA 16377->16379 16378->16376 16378->16377 16385 21b4a03 16379->16385 16381->16379 16382 21b4d24 16381->16382 16382->16379 16383 21b4d5e MultiByteToWideChar 16382->16383 16383->16379 16384 21b4d77 GetStringTypeW 16383->16384 16384->16379 16386 21b4a4f 16385->16386 16387 21b4a33 LCMapStringW 16385->16387 16390 21b4a98 LCMapStringA 16386->16390 16391 21b4ab5 16386->16391 16387->16386 16388 21b4a57 LCMapStringA 16387->16388 16388->16386 16389 21b3806 16388->16389 16389->16371 16390->16389 16391->16389 16392 21b4acb MultiByteToWideChar 16391->16392 16392->16389 16393 21b4af5 16392->16393 16393->16389 16394 21b4b2b MultiByteToWideChar 16393->16394 16394->16389 16395 21b4b44 LCMapStringW 16394->16395 16395->16389 16396 21b4b5f 16395->16396 16397 21b4b65 16396->16397 16399 21b4ba5 16396->16399 16397->16389 16398 21b4b73 LCMapStringW 16397->16398 16398->16389 16399->16389 16400 21b4bdd LCMapStringW 16399->16400 16400->16389 16401 21b4bf5 WideCharToMultiByte 16400->16401 16401->16389 16412 21b207f 16403->16412 16406 21b1feb GetCurrentProcess TerminateProcess 16409 21b1ffc 16406->16409 16407 21b206d ExitProcess 16408 21b2066 16415 21b2088 16408->16415 16409->16407 16409->16408 16413 21b321a 20 API calls 16412->16413 16414 21b1fe0 16413->16414 16414->16406 16414->16409 16418 21b327b LeaveCriticalSection 16415->16418 16417 21b1fd6 16417->16094 16418->16417 16420 21b31bb 16419->16420 16421 21b31f7 DeleteCriticalSection DeleteCriticalSection DeleteCriticalSection DeleteCriticalSection 16420->16421 16422 21b31e1 DeleteCriticalSection 16420->16422 16421->16208 16423 21b331d 20 API calls 16422->16423 16423->16420 16424 100021e2 16427 100021f4 16424->16427 16428 100021f1 16427->16428 16430 100021fb 16427->16430 16430->16428 16431 10002220 16430->16431 16432 1000224d 16431->16432 16433 10002290 16431->16433 16439 1000227b 16432->16439 16449 10001f46 16432->16449 16433->16439 16440 100022b2 16433->16440 16435 10002263 16464 1000333b 16435->16464 16436 100022ff RtlAllocateHeap 16438 10002282 16436->16438 16438->16430 16439->16436 16439->16438 16442 10001f46 28 API calls 16440->16442 16443 100022b9 16442->16443 16473 10003ae8 16443->16473 16446 100022cc 16480 100022e6 16446->16480 16450 10001f9c EnterCriticalSection 16449->16450 16451 10001f5e 16449->16451 16450->16435 16483 100021e2 16451->16483 16454 10001f74 16455 10001f46 27 API calls 16454->16455 16457 10001f7c 16455->16457 16458 10001f83 InitializeCriticalSection 16457->16458 16459 10001f8d 16457->16459 16461 10001f92 16458->16461 16492 100020f9 16459->16492 16509 10001fa7 LeaveCriticalSection 16461->16509 16463 10001f9a 16463->16450 16468 1000336d 16464->16468 16465 1000340c 16467 1000226e 16465->16467 16564 100036f5 16465->16564 16470 10002287 16467->16470 16468->16465 16468->16467 16557 10003644 16468->16557 16568 10001fa7 LeaveCriticalSection 16470->16568 16472 1000228e 16472->16439 16474 10003af6 16473->16474 16475 10003be2 VirtualAlloc 16474->16475 16476 10003cb7 16474->16476 16479 10003bb3 16474->16479 16475->16479 16569 100037f0 16476->16569 16479->16446 16479->16479 16578 10001fa7 LeaveCriticalSection 16480->16578 16482 100022d9 16482->16438 16482->16439 16484 100021f4 29 API calls 16483->16484 16485 10001f66 16484->16485 16485->16454 16486 10001186 16485->16486 16487 10001190 16486->16487 16488 100011a2 16487->16488 16510 10001d25 16487->16510 16516 10001d5e 16488->16516 16493 100021d3 16492->16493 16494 10002127 16492->16494 16493->16461 16495 10002131 16494->16495 16496 1000216c 16494->16496 16498 10001f46 28 API calls 16495->16498 16497 1000215d 16496->16497 16500 10001f46 28 API calls 16496->16500 16497->16493 16499 100021c5 HeapFree 16497->16499 16502 10002138 16498->16502 16499->16493 16506 10002178 16500->16506 16501 10002152 16536 10002163 16501->16536 16502->16501 16530 10003012 16502->16530 16505 100021a4 16543 100021bb 16505->16543 16506->16505 16539 10003aa3 16506->16539 16509->16463 16511 10001d2f 16510->16511 16512 10001d5c 16511->16512 16513 10001d5e 7 API calls 16511->16513 16512->16488 16514 10001d46 16513->16514 16515 10001d5e 7 API calls 16514->16515 16515->16512 16517 10001d71 16516->16517 16518 10001e88 16517->16518 16519 10001db1 16517->16519 16524 100011ab 16517->16524 16520 10001e9b GetStdHandle WriteFile 16518->16520 16521 10001dbd GetModuleFileNameA 16519->16521 16519->16524 16520->16524 16522 10001dd5 16521->16522 16525 10003e14 16522->16525 16524->16454 16526 10003e21 LoadLibraryA 16525->16526 16528 10003e63 16525->16528 16527 10003e32 GetProcAddress 16526->16527 16526->16528 16527->16528 16529 10003e49 GetProcAddress GetProcAddress 16527->16529 16528->16524 16529->16528 16531 10003050 16530->16531 16535 10003306 16530->16535 16532 1000324c VirtualFree 16531->16532 16531->16535 16533 100032b0 16532->16533 16534 100032bf VirtualFree HeapFree 16533->16534 16533->16535 16534->16535 16535->16501 16546 10001fa7 LeaveCriticalSection 16536->16546 16538 1000216a 16538->16497 16540 10003ad0 16539->16540 16541 10003ae6 16539->16541 16540->16541 16547 1000398a 16540->16547 16541->16505 16556 10001fa7 LeaveCriticalSection 16543->16556 16545 100021c2 16545->16497 16546->16538 16548 10003997 16547->16548 16549 10003a47 16548->16549 16550 100039b8 VirtualFree 16548->16550 16552 10003934 VirtualFree 16548->16552 16549->16541 16550->16548 16553 10003951 16552->16553 16554 10003981 16553->16554 16555 10003961 HeapFree 16553->16555 16554->16548 16555->16548 16556->16545 16558 10003687 HeapAlloc 16557->16558 16559 10003657 HeapReAlloc 16557->16559 16561 100036d7 16558->16561 16562 100036ad VirtualAlloc 16558->16562 16560 10003676 16559->16560 16559->16561 16560->16558 16561->16465 16562->16561 16563 100036c7 HeapFree 16562->16563 16563->16561 16565 10003707 VirtualAlloc 16564->16565 16567 10003750 16565->16567 16567->16467 16568->16472 16570 10003804 HeapAlloc 16569->16570 16571 100037fd 16569->16571 16572 10003821 VirtualAlloc 16570->16572 16573 10003859 16570->16573 16571->16572 16574 10003841 VirtualAlloc 16572->16574 16575 10003916 16572->16575 16573->16479 16574->16573 16576 10003908 VirtualFree 16574->16576 16575->16573 16577 1000391e HeapFree 16575->16577 16576->16575 16577->16573 16578->16482 16579 100010e9 16581 100010fc 16579->16581 16582 10001105 16579->16582 16583 1000114d 16581->16583 16584 1000112d 16581->16584 16586 10001010 105 API calls 16581->16586 16582->16581 16582->16584 16587 10001010 16582->16587 16583->16584 16585 10001010 105 API calls 16583->16585 16585->16584 16586->16583 16588 100010a5 16587->16588 16589 1000101d GetVersion 16587->16589 16590 100010d7 16588->16590 16591 100010ab 16588->16591 16616 10001c20 HeapCreate 16589->16616 16593 10001070 16590->16593 16717 100013c3 16590->16717 16591->16593 16595 100010c6 16591->16595 16704 100011f7 16591->16704 16593->16581 16594 1000102f 16594->16593 16628 100012d7 16594->16628 16707 1000161f 16595->16707 16600 10001067 16602 10001074 GetCommandLineA 16600->16602 16603 1000106b 16600->16603 16645 10001979 16602->16645 16638 10001c7d 16603->16638 16609 10001c7d 6 API calls 16609->16593 16611 1000108e 16682 1000172c 16611->16682 16613 10001093 16691 10001673 16613->16691 16615 10001098 16615->16593 16617 10001c40 16616->16617 16618 10001c76 16616->16618 16739 10001ad8 16617->16739 16618->16594 16621 10001c5c 16624 10001c79 16621->16624 16626 100037f0 5 API calls 16621->16626 16622 10001c4f 16751 10002f9f HeapAlloc 16622->16751 16624->16594 16625 10001c59 16625->16624 16627 10001c6a HeapDestroy 16625->16627 16626->16625 16627->16618 16852 10001eb1 InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 16628->16852 16630 100012dd TlsAlloc 16631 10001327 16630->16631 16632 100012ed 16630->16632 16631->16600 16633 10001fbc 30 API calls 16632->16633 16634 100012f6 16633->16634 16634->16631 16635 100012fe TlsSetValue 16634->16635 16635->16631 16636 1000130f 16635->16636 16637 10001315 GetCurrentThreadId 16636->16637 16637->16600 16639 10001c89 16638->16639 16640 10001cef 16638->16640 16642 10001cdb HeapFree 16639->16642 16643 10001ca9 VirtualFree VirtualFree HeapFree 16639->16643 16641 10001d16 HeapDestroy 16640->16641 16644 10001d02 VirtualFree 16640->16644 16641->16593 16642->16641 16643->16642 16643->16643 16644->16640 16646 10001994 GetEnvironmentStringsW 16645->16646 16647 100019c7 16645->16647 16648 100019a8 GetEnvironmentStrings 16646->16648 16649 1000199c 16646->16649 16647->16649 16650 100019b8 16647->16650 16648->16650 16651 10001084 16648->16651 16652 100019e0 WideCharToMultiByte 16649->16652 16653 100019d4 GetEnvironmentStringsW 16649->16653 16650->16651 16654 10001a66 16650->16654 16655 10001a5a GetEnvironmentStrings 16650->16655 16668 10001463 16651->16668 16657 10001a14 16652->16657 16658 10001a46 FreeEnvironmentStringsW 16652->16658 16653->16651 16653->16652 16659 100021e2 29 API calls 16654->16659 16655->16651 16655->16654 16660 100021e2 29 API calls 16657->16660 16658->16651 16666 10001a81 16659->16666 16661 10001a1a 16660->16661 16661->16658 16662 10001a23 WideCharToMultiByte 16661->16662 16664 10001a3d 16662->16664 16665 10001a34 16662->16665 16663 10001a97 FreeEnvironmentStringsA 16663->16651 16664->16658 16667 100020f9 29 API calls 16665->16667 16666->16663 16667->16664 16669 100021e2 29 API calls 16668->16669 16670 10001476 16669->16670 16671 10001484 GetStartupInfoA 16670->16671 16672 10001186 7 API calls 16670->16672 16674 100014d2 16671->16674 16675 100015a3 16671->16675 16672->16671 16674->16675 16677 10001549 16674->16677 16679 100021e2 29 API calls 16674->16679 16676 100015ce GetStdHandle 16675->16676 16678 1000160e SetHandleCount 16675->16678 16676->16675 16680 100015dc GetFileType 16676->16680 16677->16675 16681 1000156b GetFileType 16677->16681 16678->16611 16679->16674 16680->16675 16681->16677 16683 10001743 GetModuleFileNameA 16682->16683 16684 1000173e 16682->16684 16686 10001766 16683->16686 16853 10002863 16684->16853 16687 100021e2 29 API calls 16686->16687 16688 10001787 16687->16688 16689 10001186 7 API calls 16688->16689 16690 10001797 16688->16690 16689->16690 16690->16613 16692 10001680 16691->16692 16695 10001685 16691->16695 16693 10002863 48 API calls 16692->16693 16693->16695 16694 100021e2 29 API calls 16696 100016b2 16694->16696 16695->16694 16697 10001186 7 API calls 16696->16697 16701 100016c6 16696->16701 16697->16701 16698 10001709 16699 100020f9 29 API calls 16698->16699 16700 10001715 16699->16700 16700->16615 16701->16698 16702 100021e2 29 API calls 16701->16702 16703 10001186 7 API calls 16701->16703 16702->16701 16703->16701 16882 10001206 16704->16882 16709 10001627 16707->16709 16708 100010cb 16712 1000132b 16708->16712 16709->16708 16710 100020f9 29 API calls 16709->16710 16711 10001641 DeleteCriticalSection 16709->16711 16710->16709 16711->16709 16898 10001eda 16712->16898 16714 10001330 16715 100010d0 16714->16715 16716 1000133a TlsFree 16714->16716 16715->16609 16716->16715 16718 100013d1 16717->16718 16719 10001462 16717->16719 16720 100013e7 16718->16720 16721 100013da TlsGetValue 16718->16721 16719->16593 16722 100013f4 16720->16722 16724 100020f9 29 API calls 16720->16724 16721->16720 16723 10001453 TlsSetValue 16721->16723 16725 10001402 16722->16725 16726 100020f9 29 API calls 16722->16726 16723->16719 16724->16722 16727 10001410 16725->16727 16728 100020f9 29 API calls 16725->16728 16726->16725 16729 100020f9 29 API calls 16727->16729 16733 1000141e 16727->16733 16728->16727 16729->16733 16730 100020f9 29 API calls 16731 1000142c 16730->16731 16732 1000143a 16731->16732 16734 100020f9 29 API calls 16731->16734 16735 1000144b 16732->16735 16736 100020f9 29 API calls 16732->16736 16733->16730 16733->16731 16734->16732 16737 100020f9 29 API calls 16735->16737 16736->16735 16738 10001452 16737->16738 16738->16723 16753 10002f70 16739->16753 16742 10001b01 16743 10001b1b GetEnvironmentVariableA 16742->16743 16745 10001b13 16742->16745 16744 10001bf8 16743->16744 16747 10001b3a 16743->16747 16744->16745 16758 10001aab GetModuleHandleA 16744->16758 16745->16621 16745->16622 16748 10001b7f GetModuleFileNameA 16747->16748 16749 10001b77 16747->16749 16748->16749 16749->16744 16755 10002bb5 16749->16755 16752 10002fbb 16751->16752 16752->16625 16754 10001ae5 GetVersionExA 16753->16754 16754->16742 16754->16743 16760 10002bcc 16755->16760 16759 10001ac2 16758->16759 16759->16745 16762 10002be4 16760->16762 16764 10002c14 16762->16764 16769 100046c4 16762->16769 16763 10002bc8 16763->16744 16764->16763 16765 100046c4 6 API calls 16764->16765 16767 10002d3d 16764->16767 16773 10004589 16764->16773 16765->16764 16767->16763 16784 10004580 16767->16784 16770 100046e2 16769->16770 16772 100046d6 16769->16772 16787 10004437 16770->16787 16772->16762 16774 100045a7 InterlockedIncrement 16773->16774 16783 10004594 16773->16783 16775 100045c3 InterlockedDecrement 16774->16775 16778 100045cd 16774->16778 16776 10001f46 29 API calls 16775->16776 16776->16778 16799 100045f8 16778->16799 16780 100045e3 16805 10001fa7 LeaveCriticalSection 16780->16805 16781 100045ed InterlockedDecrement 16781->16783 16783->16764 16824 1000135c GetLastError TlsGetValue 16784->16824 16786 10004585 16786->16763 16788 10004468 GetStringTypeW 16787->16788 16794 10004480 16787->16794 16789 10004484 GetStringTypeA 16788->16789 16788->16794 16793 1000456c 16789->16793 16789->16794 16790 100044ab GetStringTypeA 16790->16793 16792 100044cf 16792->16793 16795 100044e5 MultiByteToWideChar 16792->16795 16793->16772 16794->16790 16794->16792 16795->16793 16796 10004509 16795->16796 16796->16793 16797 10004543 MultiByteToWideChar 16796->16797 16797->16793 16798 1000455c GetStringTypeW 16797->16798 16798->16793 16801 10004623 16799->16801 16804 100045da 16799->16804 16800 1000463f 16800->16804 16806 100041e8 16800->16806 16801->16800 16802 100046c4 6 API calls 16801->16802 16802->16800 16804->16780 16804->16781 16805->16783 16807 10004218 LCMapStringW 16806->16807 16810 10004234 16806->16810 16808 1000423c LCMapStringA 16807->16808 16807->16810 16809 10004376 16808->16809 16808->16810 16809->16804 16811 1000429a 16810->16811 16812 1000427d LCMapStringA 16810->16812 16811->16809 16813 100042b0 MultiByteToWideChar 16811->16813 16812->16809 16813->16809 16814 100042da 16813->16814 16814->16809 16815 10004310 MultiByteToWideChar 16814->16815 16815->16809 16816 10004329 LCMapStringW 16815->16816 16816->16809 16817 10004344 16816->16817 16818 1000434a 16817->16818 16820 1000438a 16817->16820 16818->16809 16819 10004358 LCMapStringW 16818->16819 16819->16809 16820->16809 16821 100043c2 LCMapStringW 16820->16821 16821->16809 16822 100043da WideCharToMultiByte 16821->16822 16822->16809 16825 100013b7 SetLastError 16824->16825 16826 10001378 16824->16826 16825->16786 16835 10001fbc 16826->16835 16829 10001389 TlsSetValue 16830 100013af 16829->16830 16831 1000139a 16829->16831 16832 10001186 7 API calls 16830->16832 16834 100013a0 GetCurrentThreadId 16831->16834 16833 100013b6 16832->16833 16833->16825 16834->16825 16843 10001ff1 16835->16843 16836 10001381 16836->16829 16836->16830 16837 10001f46 29 API calls 16837->16843 16838 100020a9 HeapAlloc 16838->16843 16839 1000333b 5 API calls 16839->16843 16840 10003ae8 6 API calls 16840->16843 16843->16836 16843->16837 16843->16838 16843->16839 16843->16840 16844 10002055 16843->16844 16847 100020de 16843->16847 16850 10001fa7 LeaveCriticalSection 16844->16850 16846 1000205c 16846->16843 16851 10001fa7 LeaveCriticalSection 16847->16851 16849 100020e5 16849->16843 16850->16846 16851->16849 16852->16630 16854 1000286c 16853->16854 16855 10002873 16853->16855 16857 1000248b 16854->16857 16855->16683 16858 10001f46 29 API calls 16857->16858 16859 1000249b 16858->16859 16868 10002638 16859->16868 16863 10002630 16863->16855 16865 100024d7 GetCPInfo 16867 100024ed 16865->16867 16866 100024b2 16881 10001fa7 LeaveCriticalSection 16866->16881 16867->16866 16873 100026de GetCPInfo 16867->16873 16869 10002658 16868->16869 16870 10002648 GetOEMCP 16868->16870 16871 100024a3 16869->16871 16872 1000265d GetACP 16869->16872 16870->16869 16871->16865 16871->16866 16871->16867 16872->16871 16874 100027c9 16873->16874 16877 10002701 16873->16877 16874->16866 16875 10004437 6 API calls 16876 1000277d 16875->16876 16878 100041e8 9 API calls 16876->16878 16877->16875 16879 100027a1 16878->16879 16880 100041e8 9 API calls 16879->16880 16880->16874 16881->16863 16891 100012ab 16882->16891 16885 10001217 GetCurrentProcess TerminateProcess 16886 10001228 16885->16886 16887 10001292 16886->16887 16888 10001299 ExitProcess 16886->16888 16894 100012b4 16887->16894 16892 10001f46 29 API calls 16891->16892 16893 1000120c 16892->16893 16893->16885 16893->16886 16897 10001fa7 LeaveCriticalSection 16894->16897 16896 10001202 16896->16595 16897->16896 16900 10001ee7 16898->16900 16899 10001f23 DeleteCriticalSection DeleteCriticalSection DeleteCriticalSection DeleteCriticalSection 16899->16714 16900->16899 16901 10001f0d DeleteCriticalSection 16900->16901 16902 100020f9 29 API calls 16901->16902 16902->16900 16903 21b3290 16904 21b32a3 16903->16904 16905 21b32dc HeapAlloc 16904->16905 16906 21b321a 20 API calls 16904->16906 16907 21b3fb9 5 API calls 16904->16907 16909 21b3307 16904->16909 16910 21b327b LeaveCriticalSection 16904->16910 16905->16904 16905->16909 16906->16904 16907->16904 16910->16904 16911 41278c 16940 419175 16911->16940 16914 4127c4 16951 4189d1 16914->16951 16915 4127ad CallNextHookEx 16916 412873 16915->16916 16919 4127e8 16922 41284f CallNextHookEx 16919->16922 16924 4127f5 GetWindowLongW 16919->16924 16920 41287c 16956 412515 16920->16956 16922->16916 16923 412866 UnhookWindowsHookEx 16922->16923 16923->16916 16924->16922 16925 412805 GetPropW 16924->16925 16925->16922 16926 412816 SetPropW GetPropW 16925->16926 16926->16922 16927 41282e GlobalAddAtomW 16926->16927 16928 412840 16927->16928 16929 412845 SetWindowLongW 16927->16929 16928->16929 16929->16922 16930 412911 16931 412919 SetWindowLongW 16930->16931 16932 412905 16931->16932 16932->16922 16936 4128ce 16937 4128d3 GetWindowLongW 16936->16937 16938 4128f0 16937->16938 16938->16932 16939 4128f4 SetWindowLongW 16938->16939 16939->16932 16941 4191ab TlsGetValue 16940->16941 16942 41917e 16940->16942 16944 4191be 16941->16944 16943 419198 16942->16943 16984 418d75 TlsAlloc 16942->16984 16974 418e0e EnterCriticalSection 16943->16974 16946 4191d1 16944->16946 16947 4127a2 16944->16947 16988 418f7d TlsGetValue 16946->16988 16947->16914 16947->16915 16949 4191a9 16949->16941 16952 419175 ctype 21 API calls 16951->16952 16953 4189e0 16952->16953 16954 4127d6 16953->16954 17011 41920a 16953->17011 16954->16919 16954->16920 16957 412521 16956->16957 16958 412525 16956->16958 16957->16930 16964 41230f 16957->16964 17034 41245e 16958->17034 16960 41252d 17042 411f20 16960->17042 16965 412319 __EH_prolog 16964->16965 16966 419175 ctype 21 API calls 16965->16966 16967 412331 16966->16967 16968 41238e 16967->16968 17188 41219c GetWindowRect 16967->17188 17181 413280 16968->17181 16971 4123b7 16971->16930 16971->16936 16980 418e2d 16974->16980 16975 418ee9 ctype 16976 418efe LeaveCriticalSection 16975->16976 16976->16949 16977 418e67 GlobalAlloc 16979 418e9c 16977->16979 16978 418e7a GlobalHandle GlobalUnlock GlobalReAlloc 16978->16979 16981 418ec5 GlobalLock 16979->16981 16982 418eaa GlobalHandle GlobalLock LeaveCriticalSection 16979->16982 16980->16975 16980->16977 16980->16978 16981->16975 17003 4119a4 16982->17003 16985 418da4 16984->16985 16986 418da9 InitializeCriticalSection 16984->16986 16987 4119a4 ctype RaiseException 16985->16987 16986->16943 16987->16986 16989 418fae 16988->16989 16993 418f94 16988->16993 17006 418d43 LocalAlloc 16989->17006 16991 419054 16991->16947 16993->16991 16995 418ff7 LocalAlloc 16993->16995 16996 419008 LocalReAlloc 16993->16996 16998 419018 16995->16998 16996->16998 17000 419024 ctype 16998->17000 17001 4119a4 ctype RaiseException 16998->17001 16999 418fe6 LeaveCriticalSection 16999->16993 17002 419043 TlsSetValue 17000->17002 17001->17000 17002->16991 17005 40a1d7 RaiseException 17003->17005 17007 418d56 17006->17007 17008 418d5b EnterCriticalSection 17006->17008 17009 4119a4 ctype RaiseException 17007->17009 17010 418cea 17008->17010 17009->17008 17010->16999 17012 419214 __EH_prolog 17011->17012 17013 419242 17012->17013 17017 41960a 17012->17017 17013->16954 17018 419615 17017->17018 17019 41961a 17017->17019 17029 419577 17018->17029 17020 41922b 17019->17020 17022 419667 EnterCriticalSection 17019->17022 17023 41963e EnterCriticalSection 17019->17023 17026 41967a 17020->17026 17022->17020 17024 41964c InitializeCriticalSection 17023->17024 17025 41965f LeaveCriticalSection 17023->17025 17024->17025 17025->17022 17027 419683 LeaveCriticalSection 17026->17027 17028 419698 17026->17028 17027->17028 17028->17013 17030 419581 GetVersion 17029->17030 17031 41959b 17029->17031 17032 4195a3 InitializeCriticalSection 17030->17032 17033 419594 17030->17033 17031->17019 17032->17031 17033->17031 17033->17032 17035 412468 __EH_prolog 17034->17035 17052 4189f7 17035->17052 17037 41246e ctype 17040 4124ac ctype 17037->17040 17057 414cc6 17037->17057 17040->16960 17044 411f34 17042->17044 17043 411f49 17174 411e55 17043->17174 17044->17043 17045 411dbc ctype 20 API calls 17044->17045 17047 411f50 17044->17047 17045->17043 17048 4147b9 17047->17048 17049 4147c0 17048->17049 17051 4147dc ctype 17048->17051 17050 4147c6 GetParent 17049->17050 17049->17051 17050->17051 17051->16957 17053 4189d1 ctype 28 API calls 17052->17053 17054 4189fc 17053->17054 17055 419175 ctype 21 API calls 17054->17055 17056 418a0d 17055->17056 17056->17037 17060 414ccc 17057->17060 17059 412490 17059->17040 17061 416217 17059->17061 17060->17059 17065 40a2cc 17060->17065 17062 416221 __EH_prolog ctype 17061->17062 17165 411dbc 17062->17165 17064 416258 17064->17040 17068 40a2de 17065->17068 17069 40a2db 17068->17069 17071 40a2e5 ctype 17068->17071 17069->17060 17071->17069 17072 40a30a 17071->17072 17073 40a318 17072->17073 17074 40a32e 17072->17074 17082 40d773 17073->17082 17075 40a340 RtlAllocateHeap 17074->17075 17078 40a335 17074->17078 17075->17078 17077 40a31f 17097 40dc87 17077->17097 17078->17071 17083 40d7c9 EnterCriticalSection 17082->17083 17084 40d78b 17082->17084 17083->17077 17085 40a2cc ctype 18 API calls 17084->17085 17086 40d793 17085->17086 17089 40d7a1 17086->17089 17106 4097c5 17086->17106 17088 40d773 ctype 18 API calls 17090 40d7a9 17088->17090 17089->17088 17091 40d7b0 InitializeCriticalSection 17090->17091 17092 40d7ba 17090->17092 17093 40d7bf 17091->17093 17112 40a358 17092->17112 17125 40d7d4 LeaveCriticalSection 17093->17125 17096 40d7c7 17096->17083 17101 40dcb9 17097->17101 17098 40dd61 17161 40e041 17098->17161 17101->17098 17104 40a325 17101->17104 17154 40df90 17101->17154 17105 40d7d4 LeaveCriticalSection 17104->17105 17105->17074 17107 4097d3 17106->17107 17108 4097ce 17106->17108 17132 40bc41 17107->17132 17126 40bc08 17108->17126 17113 40a361 17112->17113 17114 40a39e 17112->17114 17115 40d773 ctype 19 API calls 17113->17115 17114->17093 17116 40a368 ctype 17115->17116 17117 40a374 17116->17117 17118 40a387 17116->17118 17146 40d95c 17117->17146 17153 40d7d4 LeaveCriticalSection 17118->17153 17121 40a37b 17152 40d7d4 LeaveCriticalSection 17121->17152 17122 40a38e HeapFree 17122->17114 17124 40a382 17124->17093 17125->17096 17127 40bc12 17126->17127 17128 40bc41 ctype 7 API calls 17127->17128 17131 40bc3f 17127->17131 17129 40bc29 17128->17129 17130 40bc41 ctype 7 API calls 17129->17130 17130->17131 17131->17107 17134 40bc54 17132->17134 17133 4097dc 17133->17089 17134->17133 17135 40bd6b ctype 17134->17135 17136 40bc94 17134->17136 17137 40bd7e GetStdHandle WriteFile 17135->17137 17136->17133 17138 40bca0 GetModuleFileNameA 17136->17138 17137->17133 17139 40bcb8 ctype 17138->17139 17141 40f34b 17139->17141 17142 40f358 LoadLibraryA 17141->17142 17143 40f39a 17141->17143 17142->17143 17144 40f369 GetProcAddress 17142->17144 17143->17133 17144->17143 17145 40f380 GetProcAddress GetProcAddress 17144->17145 17145->17143 17147 40d9a3 17146->17147 17148 40dc4f ctype 17147->17148 17149 40db95 VirtualFree 17147->17149 17148->17121 17150 40dbf9 17149->17150 17150->17148 17151 40dc08 VirtualFree HeapFree 17150->17151 17151->17148 17152->17124 17153->17122 17155 40dfd3 HeapAlloc 17154->17155 17156 40dfa3 HeapReAlloc 17154->17156 17158 40dd58 17155->17158 17159 40dff9 VirtualAlloc 17155->17159 17157 40dfc2 17156->17157 17156->17158 17157->17155 17158->17098 17158->17104 17159->17158 17160 40e013 HeapFree 17159->17160 17160->17158 17162 40e053 VirtualAlloc 17161->17162 17164 40dd67 17162->17164 17164->17104 17166 411dc7 17165->17166 17168 411dcd 17165->17168 17171 414cef 17166->17171 17169 414cc6 ctype 20 API calls 17168->17169 17170 411de9 ctype 17168->17170 17169->17170 17170->17064 17172 40a358 ctype 20 API calls 17171->17172 17173 414cf8 17172->17173 17173->17168 17175 411e5e 17174->17175 17177 411e6c 17174->17177 17178 411d43 17175->17178 17177->17047 17179 414cc6 ctype 20 API calls 17178->17179 17180 411d55 17179->17180 17180->17177 17204 404d10 CoInitialize #17 CoCreateInstance 17181->17204 17205 4050b0 FindWindowW 17181->17205 17215 414df5 17181->17215 17182 4132a2 17183 41239f 17182->17183 17222 412cfb 17182->17222 17183->16971 17191 4121bf 17183->17191 17429 4146ac 17188->17429 17190 4121b5 17190->16968 17192 412233 17191->17192 17193 4121cc 17191->17193 17192->16971 17194 4146ac GetWindowLongW 17193->17194 17195 4121d6 17194->17195 17195->17192 17196 4121dd GetWindowRect 17195->17196 17196->17192 17197 4121f4 17196->17197 17197->17192 17198 4121fc GetWindow 17197->17198 17432 4124d0 17198->17432 17201 412218 17201->17192 17442 414114 17201->17442 17204->17182 17206 405117 GetModuleFileNameW 17205->17206 17207 4050df IsIconic 17205->17207 17210 405149 17206->17210 17208 4050f3 SetForegroundWindow SetActiveWindow 17207->17208 17209 4050ea ShowWindow 17207->17209 17208->17182 17209->17208 17227 411924 17210->17227 17216 414e01 17215->17216 17217 414e0a 17215->17217 17216->17182 17219 414e12 17217->17219 17220 414e51 17217->17220 17421 4094b7 17219->17421 17221 414cc6 ctype 20 API calls 17220->17221 17221->17216 17223 412d08 17222->17223 17224 412d2a CallWindowProcW 17222->17224 17223->17224 17226 412d16 DefWindowProcW 17223->17226 17225 412d3d 17224->17225 17225->17183 17226->17225 17235 411629 17227->17235 17230 414f8d 17231 405191 17230->17231 17232 414f9d InterlockedDecrement 17230->17232 17231->17182 17232->17231 17233 414fab 17232->17233 17234 414e79 ctype 22 API calls 17233->17234 17234->17231 17236 4118f0 17235->17236 17246 411650 17235->17246 17248 4151e8 17236->17248 17243 409e4a 7 API calls 17243->17246 17244 40ac09 6 API calls 17244->17246 17245 411857 lstrlenA 17245->17246 17246->17236 17246->17243 17246->17244 17246->17245 17247 411809 lstrlenW 17246->17247 17247->17246 17249 4151fb 17248->17249 17250 411900 17249->17250 17251 414df5 ctype 22 API calls 17249->17251 17254 40ab63 17250->17254 17252 415212 ctype 17251->17252 17266 414ef2 17252->17266 17282 40e4bf 17254->17282 17257 40ab9a 17259 40cb8d 35 API calls 17257->17259 17260 40abb7 17257->17260 17259->17260 17261 415238 17260->17261 17410 414f33 17261->17410 17263 415240 17264 405162 ShellExecuteW 17263->17264 17265 415249 lstrlenW 17263->17265 17264->17230 17265->17264 17267 414f11 17266->17267 17268 414eff InterlockedDecrement 17266->17268 17267->17250 17268->17267 17269 414f0a 17268->17269 17271 414e79 17269->17271 17272 414e81 17271->17272 17273 414e8d 17271->17273 17279 409546 17272->17279 17273->17272 17276 414eba 17273->17276 17277 414cef ctype 20 API calls 17276->17277 17278 414ebf 17277->17278 17278->17267 17280 409552 EnterCriticalSection LeaveCriticalSection 17279->17280 17281 40956d 17279->17281 17280->17281 17281->17267 17283 40ab90 17282->17283 17285 40e4e6 __aulldiv __aullrem ctype 17282->17285 17283->17257 17289 40cb8d 17283->17289 17284 40fc34 31 API calls 17284->17285 17285->17283 17285->17284 17286 40ec5d 39 API calls 17285->17286 17287 40ec2c 39 API calls 17285->17287 17288 40ec0c 39 API calls 17285->17288 17286->17285 17287->17285 17288->17285 17291 40cba3 17289->17291 17298 40cc27 17289->17298 17290 40cbfe 17292 40cc08 17290->17292 17293 40cc6f 17290->17293 17291->17290 17291->17298 17301 40f963 17291->17301 17295 40cc1f 17292->17295 17299 40cc2f 17292->17299 17294 40cca5 35 API calls 17293->17294 17294->17298 17304 40cca5 17295->17304 17298->17257 17299->17298 17318 40f88b 17299->17318 17302 40a2cc ctype 20 API calls 17301->17302 17303 40f973 17302->17303 17303->17290 17305 40ccf2 17304->17305 17306 40ccb2 17304->17306 17364 40ad46 17305->17364 17306->17305 17308 40cccd 17306->17308 17332 40f777 17308->17332 17312 40ccd4 17341 40cd0a 17312->17341 17317 40ccea 17317->17298 17319 40f8d8 17318->17319 17320 40f898 17318->17320 17321 40ad46 26 API calls 17319->17321 17320->17319 17322 40f8b3 17320->17322 17323 40f8dd 17321->17323 17324 40f777 22 API calls 17322->17324 17325 40ad4f 26 API calls 17323->17325 17326 40f8ba 17324->17326 17327 40f8e8 17325->17327 17328 40f8f0 28 API calls 17326->17328 17327->17298 17329 40f8c8 17328->17329 17409 40f7d6 LeaveCriticalSection 17329->17409 17331 40f8d0 17331->17298 17333 40f7a2 17332->17333 17334 40f7c5 EnterCriticalSection 17332->17334 17335 40d773 ctype 20 API calls 17333->17335 17334->17312 17336 40f7a9 17335->17336 17337 40f7b0 InitializeCriticalSection 17336->17337 17338 40f7bd 17336->17338 17337->17338 17370 40d7d4 LeaveCriticalSection 17338->17370 17340 40f7c4 17340->17334 17342 40cd2a 17341->17342 17360 40cce2 17341->17360 17343 40cd57 17342->17343 17371 40f8f0 17342->17371 17345 40ce29 WriteFile 17343->17345 17351 40cd68 17343->17351 17347 40cdf0 17345->17347 17348 40ce4b GetLastError 17345->17348 17346 40ce64 17349 40ad46 26 API calls 17346->17349 17346->17360 17347->17346 17353 40ce02 17347->17353 17347->17360 17348->17347 17354 40ce7e 17349->17354 17350 40cdb4 WriteFile 17350->17351 17352 40ce1e GetLastError 17350->17352 17351->17346 17351->17347 17351->17350 17352->17347 17355 40ce56 17353->17355 17356 40ce0a 17353->17356 17357 40ad4f 26 API calls 17354->17357 17381 40acd3 17355->17381 17359 40ad46 26 API calls 17356->17359 17357->17360 17361 40ce0f 17359->17361 17363 40f7d6 LeaveCriticalSection 17360->17363 17362 40ad4f 26 API calls 17361->17362 17362->17360 17363->17317 17398 40ba83 GetLastError TlsGetValue 17364->17398 17366 40ad4b 17367 40ad4f 17366->17367 17368 40ba83 26 API calls 17367->17368 17369 40ad54 17368->17369 17369->17298 17370->17340 17372 40f735 26 API calls 17371->17372 17373 40f8fc 17372->17373 17374 40f902 17373->17374 17375 40f90f SetFilePointer 17373->17375 17376 40ad46 26 API calls 17374->17376 17377 40f927 GetLastError 17375->17377 17378 40f92f 17375->17378 17379 40f907 17376->17379 17377->17378 17378->17379 17380 40acd3 26 API calls 17378->17380 17379->17343 17380->17379 17382 40ad4f 26 API calls 17381->17382 17383 40acd9 17382->17383 17384 40ad0c 17383->17384 17385 40acf5 17383->17385 17386 40ad46 26 API calls 17384->17386 17387 40ad1c 17385->17387 17389 40acff 17385->17389 17388 40ad11 17386->17388 17390 40ad39 17387->17390 17391 40ad2c 17387->17391 17388->17360 17393 40ad46 26 API calls 17389->17393 17392 40ad46 26 API calls 17390->17392 17394 40ad46 26 API calls 17391->17394 17395 40ad3e 17392->17395 17396 40ad04 17393->17396 17397 40ad31 17394->17397 17395->17360 17396->17360 17397->17360 17399 40bade SetLastError 17398->17399 17400 40ba9f 17398->17400 17399->17366 17401 40e432 21 API calls 17400->17401 17402 40baa8 17401->17402 17403 40bab0 TlsSetValue 17402->17403 17404 40bad6 17402->17404 17403->17404 17406 40bac1 17403->17406 17405 4097c5 ctype 7 API calls 17404->17405 17407 40badd 17405->17407 17408 40bac7 GetCurrentThreadId 17406->17408 17407->17399 17408->17399 17409->17331 17411 414f3f 17410->17411 17415 414f4e ctype 17410->17415 17416 414ec1 17411->17416 17414 414df5 ctype 22 API calls 17414->17415 17415->17263 17417 414ed1 InterlockedDecrement 17416->17417 17418 414ee9 17416->17418 17417->17418 17419 414edf 17417->17419 17418->17414 17420 414e79 ctype 22 API calls 17419->17420 17420->17418 17428 40a1b8 17421->17428 17423 4094c1 EnterCriticalSection 17424 409510 LeaveCriticalSection 17423->17424 17425 4094df 17423->17425 17424->17216 17426 411d43 ctype 20 API calls 17425->17426 17427 4094f1 17426->17427 17427->17424 17428->17423 17430 4146b3 GetWindowLongW 17429->17430 17431 4146bf 17429->17431 17430->17190 17433 41245e ctype 48 API calls 17432->17433 17434 4124d9 17433->17434 17470 41627c 17434->17470 17436 4124e6 17437 4147b9 GetParent 17436->17437 17438 41220d 17437->17438 17438->17201 17439 414756 17438->17439 17440 414767 17439->17440 17441 41475d IsWindowEnabled 17439->17441 17441->17201 17443 4146ac GetWindowLongW 17442->17443 17444 414127 17443->17444 17445 414131 17444->17445 17447 414147 GetWindow 17444->17447 17448 41413c GetParent 17444->17448 17446 41416e GetWindowRect 17445->17446 17449 414212 GetParent GetClientRect GetClientRect MapWindowPoints 17446->17449 17450 414187 17446->17450 17451 414152 17447->17451 17448->17451 17461 41423f 17449->17461 17453 41419b 17450->17453 17454 41418b GetWindowLongW 17450->17454 17451->17446 17452 414158 SendMessageW 17451->17452 17452->17445 17452->17446 17455 4141e9 GetWindowRect 17453->17455 17456 4141af 17453->17456 17454->17453 17457 408f9e 12 API calls 17455->17457 17476 4090b3 17456->17476 17459 4141fc 17457->17459 17462 409009 11 API calls 17459->17462 17495 4146e0 17461->17495 17464 414202 CopyRect 17462->17464 17464->17461 17471 416286 __EH_prolog ctype 17470->17471 17472 4162fb 17471->17472 17473 4119a4 ctype RaiseException 17471->17473 17475 416297 ctype 17471->17475 17474 411f20 20 API calls 17472->17474 17473->17472 17474->17475 17475->17436 17499 4154a5 17476->17499 17479 408f9e 17504 408e70 17479->17504 17482 408fc8 IsIconic 17484 408fe4 GetWindowRect 17482->17484 17485 408fd5 GetWindowPlacement 17482->17485 17483 408fad 17488 409009 17483->17488 17486 408ff1 17484->17486 17485->17486 17486->17483 17513 408f48 17486->17513 17489 408e70 7 API calls 17488->17489 17490 409016 17489->17490 17491 40901a CopyRect CopyRect 17490->17491 17492 40903f SystemParametersInfoW 17490->17492 17491->17461 17492->17491 17493 409051 GetSystemMetrics GetSystemMetrics 17492->17493 17493->17491 17494 409081 lstrcpyW 17493->17494 17494->17491 17496 4146ea SetWindowPos 17495->17496 17497 4142c2 17495->17497 17496->17497 17497->17192 17500 4189f7 ctype 28 API calls 17499->17500 17501 4154aa 17500->17501 17502 4090b8 17501->17502 17503 4189d1 ctype 28 API calls 17501->17503 17502->17479 17503->17502 17505 408e8d GetModuleHandleW 17504->17505 17506 408e7d 17504->17506 17505->17506 17507 408e9e GetProcAddress 17505->17507 17506->17482 17506->17483 17507->17506 17508 408eb5 GetProcAddress 17507->17508 17508->17506 17509 408ec6 GetProcAddress 17508->17509 17509->17506 17510 408ed7 GetProcAddress 17509->17510 17510->17506 17511 408ee8 GetProcAddress 17510->17511 17511->17506 17512 408ef9 GetProcAddress 17511->17512 17512->17506 17514 408e70 7 API calls 17513->17514 17515 408f4f 17514->17515 17516 408f53 17515->17516 17517 408f7a GetSystemMetrics 17515->17517 17516->17483 17517->17516 17518 408f87 GetSystemMetrics 17517->17518 17518->17516 17519 403350 17520 40335a 17519->17520 17562 412437 17520->17562 17523 40336a 17525 403380 GetModuleFileNameW 17526 4033c2 17525->17526 17566 4150da 17526->17566 17529 403443 GetProcAddress 17530 40347c 17529->17530 17532 403456 17529->17532 17531 4034a0 LoadLibraryW 17530->17531 17571 405940 GetModuleFileNameW 17531->17571 17532->17530 17534 40346c Sleep 17532->17534 17534->17532 17535 4034b9 GetVersionExW 17581 408d80 17535->17581 17537 4034e0 17589 4036e0 17537->17589 17540 403518 17595 404da0 LocalAlloc 17540->17595 17541 403508 17543 40351f 17544 40352f CreateThread 17543->17544 17642 404ed0 WaitForSingleObject 17543->17642 17546 403552 SetWindowLongW 17544->17546 18678 402d70 GetMessageW 17544->18678 17604 403710 17546->17604 17563 419175 ctype 21 API calls 17562->17563 17564 403365 17563->17564 17564->17523 17565 404d10 CoInitialize #17 CoCreateInstance 17564->17565 17565->17525 17567 4150e6 17566->17567 17568 4150ea lstrlenW 17566->17568 17645 415057 17567->17645 17568->17567 17570 40342c LoadLibraryW 17570->17529 17570->17530 17572 40599d 17571->17572 17573 4059c1 LoadLibraryW 17572->17573 17574 4059d9 GetLastError 17573->17574 17575 405a1b 17573->17575 17578 411924 66 API calls 17574->17578 17576 405a22 GetProcAddress GetProcAddress GetProcAddress 17575->17576 17577 405a6c 17575->17577 17576->17535 17577->17535 17579 405a04 17578->17579 17580 414f8d ctype 23 API calls 17579->17580 17580->17575 17654 408e50 17581->17654 17585 408d95 RegOpenKeyExW 17586 408dc6 17585->17586 17587 408daf RegCreateKeyW 17585->17587 17586->17537 17587->17586 17588 408dbf 17587->17588 17588->17537 17590 4036ea 17589->17590 17667 4077b0 17590->17667 17593 4034e9 CreateMutexW GetLastError 17593->17540 17593->17541 17596 404dc4 InitializeSecurityDescriptor 17595->17596 17597 404dbd 17595->17597 17598 404dd0 17596->17598 17599 404dd7 SetSecurityDescriptorDacl 17596->17599 17597->17543 17598->17543 17600 404de7 17599->17600 17601 404dee CreateFileMappingW 17599->17601 17600->17543 17602 404e20 MapViewOfFile LocalFree 17601->17602 17603 404e42 LocalFree 17601->17603 17602->17543 17603->17543 18261 406670 17604->18261 17643 404ee6 ReleaseMutex 17642->17643 17644 404f0a 17642->17644 17643->17544 17644->17544 17648 414f64 17645->17648 17647 415066 ctype 17647->17570 17649 414f74 17648->17649 17650 414f88 17649->17650 17651 414ec1 ctype 23 API calls 17649->17651 17650->17647 17652 414f80 17651->17652 17653 414df5 ctype 22 API calls 17652->17653 17653->17650 17655 408d89 17654->17655 17656 408e59 RegCloseKey 17654->17656 17657 408c70 lstrlenW 17655->17657 17656->17655 17658 408c8e 17657->17658 17659 408ca2 17658->17659 17660 408cac lstrcpynW lstrcmpiW 17658->17660 17659->17585 17661 408cf9 lstrcmpiW 17660->17661 17664 408ccf lstrcpynW 17660->17664 17663 408d16 lstrcmpiW 17661->17663 17661->17664 17663->17664 17665 408d33 lstrcmpiW 17663->17665 17664->17585 17665->17664 17666 408d50 lstrcpyW 17665->17666 17666->17585 17719 408aa0 GetModuleFileNameW 17667->17719 17669 4077f6 17726 41508a 17669->17726 17672 414f8d ctype 23 API calls 17673 407816 17672->17673 17734 41500c 17673->17734 17680 414f8d ctype 23 API calls 17681 407858 17680->17681 17682 41500c 28 API calls 17681->17682 17683 40786b 17682->17683 17684 41500c 28 API calls 17683->17684 17685 407881 17684->17685 17756 4013a0 GetPrivateProfileIntW 17685->17756 17688 41500c 28 API calls 17689 4078a7 17688->17689 17690 41500c 28 API calls 17689->17690 17691 4078bd 17690->17691 17692 4013a0 24 API calls 17691->17692 17701 4078ca 17692->17701 17693 411924 66 API calls 17693->17701 17694 41500c 28 API calls 17694->17701 17695 415182 28 API calls 17695->17701 17696 41508a 26 API calls 17696->17701 17697 414f8d 23 API calls ctype 17697->17701 17701->17693 17701->17694 17701->17695 17701->17696 17701->17697 17702 4079d6 17701->17702 17761 408bb0 17701->17761 17773 407c50 17701->17773 18065 406430 17701->18065 17703 4079fc 17702->17703 18070 407a60 17702->18070 17704 414f8d ctype 23 API calls 17703->17704 17706 407a0d 17704->17706 17707 414f8d ctype 23 API calls 17706->17707 17708 407a1b 17707->17708 17709 414f8d ctype 23 API calls 17708->17709 17710 407a29 17709->17710 17711 414f8d ctype 23 API calls 17710->17711 17712 407a37 17711->17712 17713 414f8d ctype 23 API calls 17712->17713 17714 4036f4 17713->17714 17714->17593 17715 406400 17714->17715 17716 406411 17715->17716 17717 406430 67 API calls 17716->17717 17718 406427 17716->17718 17717->17716 17718->17593 17720 408b28 17719->17720 17723 408b46 17719->17723 17721 41500c 28 API calls 17720->17721 17722 408b3b 17721->17722 17722->17669 18105 414fb7 17723->18105 17725 408b97 17725->17669 17727 41509a 17726->17727 17732 407808 17726->17732 17728 4150b1 17727->17728 17729 4150be 17727->17729 17730 415057 ctype 25 API calls 17728->17730 17731 414ec1 ctype 23 API calls 17729->17731 17730->17732 17733 4150c5 InterlockedIncrement 17731->17733 17732->17672 17733->17732 17735 415020 lstrlenA 17734->17735 17736 41502b 17734->17736 17735->17736 17737 407824 17736->17737 17738 414df5 ctype 22 API calls 17736->17738 17743 415182 17737->17743 17739 415039 17738->17739 18128 415282 17739->18128 17741 415043 17742 415238 26 API calls 17741->17742 17742->17737 17744 41518c __EH_prolog 17743->17744 18133 415141 17744->18133 17746 4151bb 18137 414cfa 17746->18137 17749 414f8d ctype 23 API calls 17750 407840 17749->17750 17751 401050 17750->17751 17752 41508a 26 API calls 17751->17752 17753 40108d 17752->17753 17754 414f8d ctype 23 API calls 17753->17754 17755 40109e 17754->17755 17755->17680 17757 414f8d ctype 23 API calls 17756->17757 17758 4013e1 17757->17758 17759 414f8d ctype 23 API calls 17758->17759 17760 4013f2 17759->17760 17760->17688 17762 408bd1 17761->17762 18142 415b69 17762->18142 17765 408bf4 18155 415aac 17765->18155 17766 408c16 18161 415d84 17766->18161 17771 415aac ctype 30 API calls 17772 408c30 17771->17772 17772->17701 17774 414fb7 58 API calls 17773->17774 17775 407c95 17774->17775 17776 401050 27 API calls 17775->17776 17777 407c9e 17776->17777 17778 41500c 28 API calls 17777->17778 17779 407cbb 17778->17779 17780 41500c 28 API calls 17779->17780 17781 407cd4 17780->17781 17782 41500c 28 API calls 17781->17782 17783 407ced 17782->17783 18209 4010c0 17783->18209 17786 41508a 26 API calls 17787 407d14 17786->17787 17788 414f8d ctype 23 API calls 17787->17788 17789 407d24 17788->17789 17790 41500c 28 API calls 17789->17790 17791 407d49 17790->17791 17792 41500c 28 API calls 17791->17792 17793 407d62 17792->17793 17794 41500c 28 API calls 17793->17794 17795 407d7b 17794->17795 17796 4010c0 60 API calls 17795->17796 18066 411924 66 API calls 18065->18066 18067 40646e 18066->18067 18068 414f8d ctype 23 API calls 18067->18068 18069 40664a 18068->18069 18069->17701 18071 407a7b 18070->18071 18227 4062e0 RegOpenKeyExW 18071->18227 18074 407a99 18074->17703 18076 407ab9 18231 409e4a WideCharToMultiByte 18076->18231 18080 407ae4 18081 409e4a 7 API calls 18080->18081 18082 407aee 18081->18082 18235 406320 RegQueryValueExW 18082->18235 18084 407b08 18085 409e4a 7 API calls 18084->18085 18086 407b12 18085->18086 18236 406320 RegQueryValueExW 18086->18236 18088 407b28 18089 409e4a 7 API calls 18088->18089 18090 407b32 18089->18090 18237 406320 RegQueryValueExW 18090->18237 18092 407b4b 18093 409e4a 7 API calls 18092->18093 18094 407b55 RegCloseKey 18093->18094 18096 4062e0 2 API calls 18094->18096 18097 407bc2 18096->18097 18098 407bc9 18097->18098 18238 406320 RegQueryValueExW 18097->18238 18098->17703 18100 407bea 18101 409e4a 7 API calls 18100->18101 18106 414fcb 18105->18106 18112 414fde ctype 18105->18112 18107 414fe0 lstrlenW 18106->18107 18108 414fd5 18106->18108 18110 414fed 18107->18110 18107->18112 18113 4165b8 18108->18113 18111 414df5 ctype 22 API calls 18110->18111 18111->18112 18112->17725 18124 41663c 18113->18124 18116 4165e6 18117 4150da ctype 26 API calls 18116->18117 18123 4165f5 18117->18123 18118 4151e8 25 API calls 18120 4165fe 18118->18120 18119 41663c 29 API calls 18119->18120 18120->18118 18120->18119 18121 416624 18120->18121 18122 415238 26 API calls 18121->18122 18122->18123 18123->18112 18125 4189d1 ctype 28 API calls 18124->18125 18126 416642 LoadStringW 18125->18126 18127 4165db 18126->18127 18127->18116 18127->18120 18129 415296 MultiByteToWideChar 18128->18129 18130 41528e 18128->18130 18132 4152af 18129->18132 18130->18129 18131 415292 18130->18131 18131->17741 18132->17741 18134 415155 18133->18134 18135 41515b ctype 18133->18135 18136 414df5 ctype 22 API calls 18134->18136 18135->17746 18136->18135 18138 414d17 18137->18138 18139 414d09 InterlockedIncrement 18137->18139 18141 4150da ctype 26 API calls 18138->18141 18140 414d27 18139->18140 18140->17749 18141->18140 18169 414f15 18142->18169 18147 4150da ctype 26 API calls 18148 415baf CreateFileW 18147->18148 18150 408bed 18148->18150 18151 415c4f 18148->18151 18150->17765 18150->17766 18151->18150 18152 415c56 GetLastError 18151->18152 18153 415c65 ctype 18152->18153 18154 4150da ctype 26 API calls 18153->18154 18154->18150 18156 415ab6 __EH_prolog 18155->18156 18157 415adb 18156->18157 18159 415d84 ctype 29 API calls 18156->18159 18158 414f8d ctype 23 API calls 18157->18158 18160 408c05 18158->18160 18159->18157 18160->17701 18162 415da0 18161->18162 18163 415d92 CloseHandle 18161->18163 18164 414f15 ctype 26 API calls 18162->18164 18163->18162 18165 415db0 18164->18165 18166 408c1f 18165->18166 18167 415db6 GetLastError 18165->18167 18166->17771 18196 416871 18167->18196 18170 414f32 18169->18170 18171 414f1d 18169->18171 18173 415e95 18170->18173 18172 4150da ctype 26 API calls 18171->18172 18172->18170 18188 40a1b8 18173->18188 18175 415e9f GetFullPathNameW 18176 415ec2 lstrcpynW 18175->18176 18177 415ed4 18175->18177 18186 415ba1 18176->18186 18189 415f65 18177->18189 18180 415f05 18181 415f12 18180->18181 18182 415f0b CharUpperW 18180->18182 18184 415f44 18181->18184 18185 415f18 FindFirstFileW 18181->18185 18182->18181 18183 414f8d ctype 23 API calls 18183->18186 18184->18183 18185->18184 18187 415f2d FindClose lstrcpyW 18185->18187 18186->18147 18187->18184 18188->18175 18190 4151e8 25 API calls 18189->18190 18191 415f77 ctype 18190->18191 18192 415f83 lstrcpynW 18191->18192 18195 415f9f 18192->18195 18193 415238 26 API calls 18194 415eeb GetVolumeInformationW 18193->18194 18194->18180 18194->18184 18195->18193 18197 416878 ctype 18196->18197 18198 41688f 18196->18198 18200 416932 18197->18200 18198->18166 18201 41693c __EH_prolog 18200->18201 18202 414cc6 ctype 20 API calls 18201->18202 18203 416946 ctype 18202->18203 18204 416983 18203->18204 18206 4150da ctype 26 API calls 18203->18206 18208 40a1d7 RaiseException 18204->18208 18206->18204 18207 41699c 18208->18207 18225 409c70 18209->18225 18212 414fb7 58 API calls 18213 401131 18212->18213 18214 414f8d ctype 23 API calls 18213->18214 18215 40114d 18214->18215 18216 414f8d ctype 23 API calls 18215->18216 18217 401161 18216->18217 18218 414f8d ctype 23 API calls 18217->18218 18219 401175 18218->18219 18219->17786 18226 4010df GetPrivateProfileStringW 18225->18226 18226->18212 18228 406310 18227->18228 18229 406307 RegCreateKeyW 18227->18229 18228->18074 18230 406320 RegQueryValueExW 18228->18230 18229->18228 18230->18076 18239 40d682 18231->18239 18234 406320 RegQueryValueExW 18234->18080 18235->18084 18236->18088 18237->18092 18238->18100 18241 40d68a 18239->18241 18243 40d6b8 18241->18243 18245 40fb85 18241->18245 18242 40fb85 6 API calls 18242->18243 18243->18242 18244 407ac3 18243->18244 18244->18234 18246 40fb97 18245->18246 18247 40fba3 18245->18247 18246->18241 18249 410418 18247->18249 18250 410461 18249->18250 18251 410449 GetStringTypeW 18249->18251 18253 4104b0 18250->18253 18254 41048c GetStringTypeA 18250->18254 18251->18250 18252 410465 GetStringTypeA 18251->18252 18252->18250 18255 41054d 18252->18255 18253->18255 18257 4104c6 MultiByteToWideChar 18253->18257 18254->18255 18255->18246 18257->18255 18258 4104ea ctype 18257->18258 18258->18255 18259 410524 MultiByteToWideChar 18258->18259 18259->18255 18260 41053d GetStringTypeW 18259->18260 18260->18255 18262 4066b5 18261->18262 18263 4066d5 18261->18263 18262->18263 18308 406910 18262->18308 18264 408aa0 61 API calls 18263->18264 18266 4066e2 18264->18266 18267 41508a 26 API calls 18266->18267 18268 4066f4 18267->18268 18269 414f8d ctype 23 API calls 18268->18269 18270 406702 18269->18270 18271 41500c 28 API calls 18270->18271 18272 406710 18271->18272 18273 415182 28 API calls 18272->18273 18274 40672c 18273->18274 18275 401050 27 API calls 18274->18275 18309 40692b 18308->18309 18310 4062e0 2 API calls 18309->18310 18311 406942 18310->18311 18312 406956 wsprintfW 18311->18312 18313 406949 18311->18313 18623 406360 18312->18623 18313->18263 18315 40698a wsprintfW 18316 406360 RegSetValueExW 18315->18316 18626 409c9f 18623->18626 18627 40636b RegSetValueExW 18626->18627 18627->18315 18679 402de7 18678->18679 18680 402d8b 18678->18680 18681 402d9a 18680->18681 18682 402dce GetMessageW 18680->18682 18681->18682 18685 403ee0 18681->18685 18682->18680 18684 402ddf 18682->18684 18686 403f10 18685->18686 18687 403f7f 18686->18687 18726 403fca 18686->18726 18688 403fc5 18687->18688 18729 406120 18687->18729 18688->18681 18689 40464f wsprintfW OutputDebugStringW 18696 404a58 18689->18696 18725 40469e 18689->18725 18690 404646 18690->18689 18692 414cef 20 API calls ctype 18692->18696 18694 414cef 20 API calls ctype 18697 404b16 18694->18697 18696->18692 18696->18697 18697->18688 18697->18694 18698 4044d9 Sleep 18698->18726 18699 4043f0 GetMessageExtraInfo mouse_event Sleep 18699->18726 18700 404414 GetMessageExtraInfo mouse_event Sleep 18700->18726 18701 4044c5 GetMessageExtraInfo 18711 4044ce mouse_event 18701->18711 18702 404457 GetMessageExtraInfo mouse_event Sleep 18702->18726 18703 404478 GetMessageExtraInfo mouse_event Sleep 18703->18726 18704 404499 GetMessageExtraInfo mouse_event Sleep 18704->18726 18705 4044ba GetMessageExtraInfo 18705->18711 18706 40438d GetMessageExtraInfo mouse_event Sleep 18706->18726 18707 4043ae GetMessageExtraInfo mouse_event Sleep 18707->18726 18708 4043cf GetMessageExtraInfo mouse_event Sleep 18708->18726 18709 40453e MapVirtualKeyW keybd_event 18710 40457a Sleep 18709->18710 18709->18726 18710->18726 18711->18698 18712 414cef 20 API calls ctype 18712->18725 18713 408a20 MapVirtualKeyW 18713->18725 18714 4045a2 Sleep 18717 4045bb keybd_event keybd_event 18714->18717 18714->18726 18715 404599 Sleep 18715->18726 18716 404a45 Sleep 18716->18696 18716->18725 18723 4045d4 Sleep 18717->18723 18717->18726 18718 404970 GetMessageExtraInfo mouse_event 18718->18716 18719 4049c1 GetMessageExtraInfo mouse_event 18719->18716 18720 4049a4 GetMessageExtraInfo mouse_event 18720->18716 18721 404956 GetMessageExtraInfo mouse_event 18721->18716 18722 40498a GetMessageExtraInfo mouse_event 18722->18716 18723->18717 18723->18726 18724 404a30 MapVirtualKeyW keybd_event 18724->18716 18725->18696 18725->18712 18725->18713 18725->18716 18725->18718 18725->18719 18725->18720 18725->18721 18725->18722 18725->18724 18726->18689 18726->18690 18726->18698 18726->18699 18726->18700 18726->18701 18726->18702 18726->18703 18726->18704 18726->18705 18726->18706 18726->18707 18726->18708 18726->18709 18726->18714 18726->18715 18727 405f30 20 API calls 18726->18727 18728 406090 20 API calls 18726->18728 18735 405c30 18726->18735 18755 408a20 18726->18755 18727->18726 18728->18726 18730 414cef ctype 20 API calls 18729->18730 18731 406135 18730->18731 18732 406175 18731->18732 18733 414cef ctype 20 API calls 18731->18733 18732->18687 18734 40616e 18733->18734 18734->18687 18736 405de1 18735->18736 18737 405c43 18735->18737 18738 414cc6 ctype 20 API calls 18736->18738 18737->18736 18739 405c51 18737->18739 18740 405deb 18738->18740 18741 405dc1 18739->18741 18745 414cc6 ctype 20 API calls 18739->18745 18742 405df7 18740->18742 18743 405e59 18740->18743 18741->18726 18744 414cc6 ctype 20 API calls 18742->18744 18743->18741 18746 4061a0 20 API calls 18743->18746 18744->18741 18747 405c75 18745->18747 18746->18741 18748 405c81 18747->18748 18749 405cee 18747->18749 18751 414cc6 ctype 20 API calls 18748->18751 18750 405cff 18749->18750 18759 4061a0 18749->18759 18750->18726 18752 405c8f 18751->18752 18752->18726 18756 408a33 18755->18756 18758 408a4f 18755->18758 18757 408a52 MapVirtualKeyW 18756->18757 18756->18758 18757->18726 18758->18726 18760 4061b5 18759->18760 18765 4014b0 wsprintfW 18766 4014fe 18765->18766 18767 401521 CreateMutexW GetLastError 18766->18767 18768 401593 18767->18768 18769 401543 CloseHandle 18767->18769 18772 414cc6 ctype 20 API calls 18768->18772 18770 401579 18769->18770 18771 401559 FindWindowW PostMessageW 18769->18771 18771->18770 18773 40159d 18772->18773 18776 402ee0 18773->18776 18781 41305e 18776->18781 18801 4187a4 18781->18801 18784 4189d1 ctype 28 API calls 18786 413076 18784->18786 18785 41309f wsprintfW 18787 4130b9 GetClassInfoW 18785->18787 18786->18785 18788 41308a wsprintfW 18786->18788 18789 402f08 18787->18789 18790 4130c9 18787->18790 18788->18787 18794 4129be 18789->18794 18804 412fba 18790->18804 18795 4189d1 ctype 28 API calls 18794->18795 18796 412a08 18795->18796 18800 4015d8 18796->18800 18825 412930 18796->18825 18802 419175 ctype 21 API calls 18801->18802 18803 41306c 18802->18803 18803->18784 18823 40a1b8 18804->18823 18806 412fc4 GetClassInfoW 18807 412fe4 RegisterClassW 18806->18807 18808 412ff0 18806->18808 18807->18808 18809 412ff4 18807->18809 18808->18789 18817 417214 18808->18817 18810 4189d1 ctype 28 API calls 18809->18810 18811 412ff9 18810->18811 18811->18808 18812 41960a ctype 6 API calls 18811->18812 18813 413007 18812->18813 18814 4189d1 ctype 28 API calls 18813->18814 18815 41300f lstrcatW lstrcatW 18814->18815 18816 41967a ctype LeaveCriticalSection 18815->18816 18816->18808 18824 40a1d7 RaiseException 18817->18824 18819 41722d 18820 417239 GetWindowLongW 18819->18820 18821 41724c 18819->18821 18820->18821 18822 417250 GetClassNameW lstrcmpiW 18820->18822 18821->18789 18822->18821 18823->18806 18824->18819 18826 419175 ctype 21 API calls 18825->18826 18827 412941 18826->18827 18828 412974 CreateWindowExW 18827->18828 18829 412952 GetCurrentThreadId SetWindowsHookExW 18827->18829 18832 41297c 18828->18832 18829->18828 18830 41296f 18829->18830 18831 4119a4 ctype RaiseException 18830->18831 18831->18828 18833 419175 ctype 21 API calls 18832->18833 18834 41298c 18833->18834 18835 4189d1 ctype 28 API calls 18834->18835 18836 412993 18835->18836 18837 4129a0 UnhookWindowsHookEx 18836->18837 18838 4129ab 18836->18838 18837->18838 18838->18800 18839 412710 18840 41920a ctype 7 API calls 18839->18840 18845 412724 18840->18845 18843 41276e 18844 412772 18843->18844 18846 4125b1 18843->18846 18845->18843 18873 41409f 18845->18873 18881 40a1b8 18846->18881 18848 4125bb GetPropW 18849 41269b 18848->18849 18850 4125ee 18848->18850 18851 4124d0 49 API calls 18849->18851 18852 4125f7 18850->18852 18853 41267a 18850->18853 18854 4126a3 18851->18854 18855 412656 SetWindowLongW RemovePropW GlobalFindAtomW GlobalDeleteAtom 18852->18855 18856 4125fc 18852->18856 18857 4124d0 49 API calls 18853->18857 18858 4124d0 49 API calls 18854->18858 18860 4126b9 CallWindowProcW 18855->18860 18859 412607 18856->18859 18856->18860 18861 412680 18857->18861 18862 4126ab 18858->18862 18863 4124d0 49 API calls 18859->18863 18864 412642 18860->18864 18882 412299 18861->18882 18896 412238 18862->18896 18867 41260d 18863->18867 18864->18844 18870 41219c 2 API calls 18867->18870 18869 4126b5 18869->18860 18869->18864 18871 41261d CallWindowProcW 18870->18871 18872 4121bf 83 API calls 18871->18872 18872->18864 18874 4140ab 18873->18874 18875 41410e 18873->18875 18874->18875 18876 4140d4 GetObjectW SetBkColor 18874->18876 18929 41722d 18874->18929 18875->18843 18878 4140f7 GetSysColor 18876->18878 18879 4140ff SetTextColor 18876->18879 18878->18879 18879->18875 18881->18848 18883 4122a3 18882->18883 18884 412308 18882->18884 18883->18884 18905 4139ec 18883->18905 18884->18869 18886 4122c6 18886->18884 18887 4122ca GetLastActivePopup 18886->18887 18888 4124d0 49 API calls 18887->18888 18889 4122d9 18888->18889 18889->18884 18890 4122df GetForegroundWindow 18889->18890 18891 4124d0 49 API calls 18890->18891 18892 4122eb 18891->18892 18892->18884 18893 414756 IsWindowEnabled 18892->18893 18894 4122f6 18893->18894 18894->18884 18895 4122fa SetForegroundWindow 18894->18895 18895->18884 18897 4146ac GetWindowLongW 18896->18897 18898 41224a 18897->18898 18899 412292 18898->18899 18900 4139ec 53 API calls 18898->18900 18899->18869 18901 412258 18900->18901 18902 4139ec 53 API calls 18901->18902 18903 412264 18902->18903 18903->18899 18904 41227d SendMessageW 18903->18904 18904->18899 18906 4139f7 18905->18906 18908 4139f0 18905->18908 18906->18886 18908->18906 18909 413a0c 18908->18909 18912 4139a7 18908->18912 18910 4124d0 49 API calls 18909->18910 18911 413a12 18910->18911 18911->18886 18921 4124f7 18912->18921 18914 4139b2 18915 4139c6 GetWindowLongW 18914->18915 18916 4139b6 18914->18916 18918 4139d6 GetParent 18915->18918 18919 4139df GetWindow 18915->18919 18924 40909c 18916->18924 18920 4139bd 18918->18920 18919->18920 18920->18908 18922 41245e ctype 48 API calls 18921->18922 18923 4124fe ctype 18922->18923 18923->18914 18925 4090a3 GetParent 18924->18925 18926 4090ac 18924->18926 18925->18926 18927 4124d0 49 API calls 18926->18927 18928 4090b2 18927->18928 18928->18920 18930 417239 GetWindowLongW 18929->18930 18931 4140d0 18929->18931 18930->18931 18932 417250 GetClassNameW lstrcmpiW 18930->18932 18931->18875 18931->18876 18932->18931 18933 40e432 18934 40e445 ctype 18933->18934 18935 40e47e HeapAlloc 18934->18935 18936 40d773 ctype 20 API calls 18934->18936 18937 40dc87 ctype 5 API calls 18934->18937 18939 40e4a9 ctype 18934->18939 18940 40d7d4 LeaveCriticalSection 18934->18940 18935->18934 18935->18939 18936->18934 18937->18934 18940->18934 18941 419395 18946 41939f 18941->18946 18943 41939a 18954 409d3a 18943->18954 18947 419411 GetVersion 18946->18947 18948 419452 GetProcessVersion 18947->18948 18949 419464 18947->18949 18948->18949 18957 4163e4 KiUserCallbackDispatcher GetSystemMetrics 18949->18957 18951 41946b 18964 4163a0 7 API calls 18951->18964 18953 419475 LoadCursorW LoadCursorW 18953->18943 18969 409cbc 18954->18969 18958 416403 18957->18958 18959 41640a 18957->18959 18965 4193bf 18958->18965 18968 4193ef GetSystemMetrics GetSystemMetrics 18959->18968 18963 41640f GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 18963->18951 18964->18953 18966 4193c8 GetSystemMetrics GetSystemMetrics 18965->18966 18967 416408 18965->18967 18966->18967 18967->18963 18968->18963 18980 40ab37 18969->18980 18973 409cfa 19006 40ab40 18973->19006 18975 40ac17 21 API calls 18976 409ceb 18975->18976 18992 40c6b3 18976->18992 18981 40d773 ctype 20 API calls 18980->18981 18982 409cc2 18981->18982 18983 40ac17 18982->18983 18984 40d773 ctype 20 API calls 18983->18984 18985 40ac1f ctype 18984->18985 18986 40ac3f 18985->18986 18987 40ac2f 18985->18987 19010 40d7d4 LeaveCriticalSection 18986->19010 19009 40d7d4 LeaveCriticalSection 18987->19009 18990 40ac46 HeapSize 18991 409ccd 18990->18991 18991->18973 18991->18975 18993 40c6c0 18992->18993 18994 40c6ce 18992->18994 18995 40a2cc ctype 20 API calls 18993->18995 18996 40c6d5 18994->18996 19005 40c6e3 ctype 18994->19005 18998 40c6c8 18995->18998 18997 40a358 ctype 20 API calls 18996->18997 18997->18998 18998->18973 18999 40d773 ctype 20 API calls 18999->19005 19000 40d7d4 LeaveCriticalSection ctype 19000->19005 19001 40c759 HeapAlloc 19001->19005 19002 40c7ab HeapReAlloc 19002->19005 19003 40dc87 ctype 5 API calls 19003->19005 19004 40d95c VirtualFree VirtualFree HeapFree ctype 19004->19005 19005->18998 19005->18999 19005->19000 19005->19001 19005->19002 19005->19003 19005->19004 19011 40d7d4 LeaveCriticalSection 19006->19011 19008 409d36 19009->18991 19010->18990 19011->19008 19012 415a17 KiUserCallbackDispatcher 19013 415a51 19012->19013 19014 415a2e 19012->19014 19014->19013 19015 415a43 TranslateMessage DispatchMessageW 19014->19015 19015->19013 19016 21b1060 SetWindowsHookExA 19017 41257c 19018 412588 19017->19018 19019 41258d 19017->19019 19020 4124f7 48 API calls 19019->19020 19021 412595 19020->19021 19022 41230f 143 API calls 19021->19022 19022->19018 19023 4096be GetVersion 19056 40baea HeapCreate 19023->19056 19025 40971c 19026 409721 19025->19026 19027 409729 19025->19027 19141 4097ea 19026->19141 19063 40ba1c 19027->19063 19030 40972e 19032 409732 19030->19032 19033 40973a 19030->19033 19034 4097ea 8 API calls 19032->19034 19073 40b860 19033->19073 19036 409739 19034->19036 19036->19033 19037 409744 19087 40b7bf 19037->19087 19043 40975d 19127 40b371 19043->19127 19045 409762 19046 409767 GetStartupInfoW 19045->19046 19047 409779 19046->19047 19048 409782 19047->19048 19049 40978b GetModuleHandleA 19048->19049 19138 4115ca 19049->19138 19057 40bb0a 19056->19057 19058 40bb1f 19056->19058 19161 40d8f3 HeapAlloc 19057->19161 19058->19025 19061 40bb22 19061->19025 19062 40bb13 HeapDestroy 19062->19058 19163 40d74a InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 19063->19163 19065 40ba22 TlsAlloc 19066 40ba32 19065->19066 19067 40ba6c 19065->19067 19164 40e432 19066->19164 19067->19030 19069 40ba3b 19069->19067 19070 40ba43 TlsSetValue 19069->19070 19070->19067 19071 40ba54 19070->19071 19072 40ba5a GetCurrentThreadId 19071->19072 19072->19030 19074 40a2cc ctype 20 API calls 19073->19074 19075 40b873 19074->19075 19076 40b881 GetStartupInfoA 19075->19076 19077 4097c5 ctype 7 API calls 19075->19077 19083 40b9a0 19076->19083 19086 40b8cf 19076->19086 19077->19076 19079 40b9cb GetStdHandle 19082 40b9d9 GetFileType 19079->19082 19079->19083 19080 40ba0b SetHandleCount 19080->19037 19081 40a2cc ctype 20 API calls 19081->19086 19082->19083 19083->19079 19083->19080 19084 40b946 19084->19083 19085 40b968 GetFileType 19084->19085 19085->19084 19086->19081 19086->19083 19086->19084 19088 40b7d8 GetCommandLineW 19087->19088 19089 40b7fc 19087->19089 19092 40b7ea GetCommandLineA 19088->19092 19093 40b7de 19088->19093 19090 40b801 GetCommandLineW 19089->19090 19091 40b7f0 19089->19091 19099 409749 19090->19099 19094 40b80a GetCommandLineA MultiByteToWideChar 19091->19094 19091->19099 19092->19091 19092->19099 19093->19090 19095 40b82b 19094->19095 19094->19099 19096 40a2cc ctype 20 API calls 19095->19096 19097 40b834 19096->19097 19098 40b83b MultiByteToWideChar 19097->19098 19097->19099 19098->19099 19100 40b84e 19098->19100 19102 40b652 19099->19102 19101 40a358 ctype 20 API calls 19100->19101 19101->19099 19103 40b670 GetEnvironmentStringsW 19102->19103 19104 40b69c 19102->19104 19105 40b684 GetEnvironmentStrings 19103->19105 19106 40b678 19103->19106 19104->19106 19107 40b690 19104->19107 19105->19107 19108 409753 19105->19108 19109 40b6b1 19106->19109 19110 40b6a5 GetEnvironmentStringsW 19106->19110 19107->19108 19111 40b6fc GetEnvironmentStrings 19107->19111 19119 40b704 ctype 19107->19119 19147 40b429 GetModuleFileNameW 19108->19147 19112 40a2cc ctype 20 API calls 19109->19112 19110->19108 19110->19109 19111->19108 19111->19119 19116 40b6d4 ctype 19112->19116 19113 40b738 19115 40a2cc ctype 20 API calls 19113->19115 19114 40b70b MultiByteToWideChar 19114->19108 19114->19119 19117 40b747 19115->19117 19118 40b6db FreeEnvironmentStringsW 19116->19118 19120 40b74e FreeEnvironmentStringsA 19117->19120 19125 40b75d ctype 19117->19125 19118->19108 19119->19113 19119->19114 19120->19108 19121 40b7a5 FreeEnvironmentStringsA 19121->19108 19122 40b766 MultiByteToWideChar 19123 40b7ab 19122->19123 19122->19125 19126 40a358 ctype 20 API calls 19123->19126 19125->19121 19125->19122 19126->19121 19128 40b37b 19127->19128 19129 40a2cc ctype 20 API calls 19128->19129 19130 40b3a4 19129->19130 19131 4097c5 ctype 7 API calls 19130->19131 19134 40b3b8 19130->19134 19131->19134 19132 40b405 19133 40a358 ctype 20 API calls 19132->19133 19135 40b411 19133->19135 19134->19132 19136 40a2cc ctype 20 API calls 19134->19136 19137 4097c5 ctype 7 API calls 19134->19137 19135->19045 19136->19134 19137->19134 19172 416c1b 19138->19172 19142 4097f3 19141->19142 19143 4097f8 19141->19143 19144 40bc08 ctype 7 API calls 19142->19144 19145 40bc41 ctype 7 API calls 19143->19145 19144->19143 19146 409801 ExitProcess 19145->19146 19148 40b456 19147->19148 19149 40a2cc ctype 20 API calls 19148->19149 19150 40b47b 19149->19150 19151 4097c5 ctype 7 API calls 19150->19151 19152 40b48b 19150->19152 19151->19152 19152->19043 19153 40aa70 19250 40aa92 19153->19250 19156 40b1b4 19157 40ba83 26 API calls 19156->19157 19158 40b1bf 19157->19158 19159 40b2e5 UnhandledExceptionFilter 19158->19159 19160 4097b7 19158->19160 19159->19160 19162 40bb0f 19161->19162 19162->19061 19162->19062 19163->19065 19165 40e445 ctype 19164->19165 19166 40e47e HeapAlloc 19165->19166 19167 40d773 ctype 20 API calls 19165->19167 19168 40dc87 ctype 5 API calls 19165->19168 19170 40e4a9 ctype 19165->19170 19171 40d7d4 LeaveCriticalSection 19165->19171 19166->19165 19166->19170 19167->19165 19168->19165 19170->19069 19171->19165 19173 4154a5 28 API calls 19172->19173 19174 416c26 19173->19174 19175 4189d1 ctype 28 API calls 19174->19175 19176 416c2d 19175->19176 19181 41977b SetErrorMode SetErrorMode 19176->19181 19182 4189d1 ctype 28 API calls 19181->19182 19183 419792 19182->19183 19184 4189d1 ctype 28 API calls 19183->19184 19185 4197a1 19184->19185 19186 4197c7 19185->19186 19212 4197de 19185->19212 19188 4189d1 ctype 28 API calls 19186->19188 19189 4197cc 19188->19189 19190 416c45 19189->19190 19230 4154ba 19189->19230 19192 4199fd 19190->19192 19193 4189d1 ctype 28 API calls 19192->19193 19194 419a06 19193->19194 19195 41960a ctype 6 API calls 19194->19195 19196 419a0f 19195->19196 19197 419a3e 19196->19197 19201 4189d1 ctype 28 API calls 19196->19201 19198 41967a ctype LeaveCriticalSection 19197->19198 19199 419a49 19198->19199 19200 4189d1 ctype 28 API calls 19199->19200 19202 419a4e 19200->19202 19203 419a2f UnregisterClassW 19201->19203 19204 4187a4 21 API calls 19202->19204 19203->19196 19205 419a66 19204->19205 19206 4189d1 ctype 28 API calls 19205->19206 19207 419a8b 19206->19207 19208 40979d 19207->19208 19209 419aa3 19207->19209 19210 419a9d UnhookWindowsHookEx 19207->19210 19208->19153 19209->19208 19211 419aaa UnhookWindowsHookEx 19209->19211 19210->19209 19211->19208 19213 4189d1 ctype 28 API calls 19212->19213 19214 4197f1 GetModuleFileNameW 19213->19214 19215 419823 19214->19215 19241 4198fd 19215->19241 19218 419856 19220 419890 19218->19220 19223 41663c 29 API calls 19218->19223 19221 4198a8 lstrcpyW 19220->19221 19222 4198c2 19220->19222 19224 40aa15 20 API calls 19221->19224 19225 4198d3 lstrcatW 19222->19225 19226 4198f1 19222->19226 19227 419878 19223->19227 19224->19222 19228 40aa15 20 API calls 19225->19228 19226->19186 19229 40aa15 20 API calls 19227->19229 19228->19226 19229->19220 19231 4189d1 ctype 28 API calls 19230->19231 19232 4154bf 19231->19232 19233 415517 19232->19233 19234 4187a4 21 API calls 19232->19234 19233->19190 19235 4154cb GetCurrentThreadId SetWindowsHookExW 19234->19235 19236 41920a ctype 7 API calls 19235->19236 19237 4154f5 19236->19237 19238 415502 19237->19238 19239 4189d1 ctype 28 API calls 19237->19239 19240 419175 ctype 21 API calls 19238->19240 19239->19238 19240->19233 19242 419908 19241->19242 19243 419930 lstrlenW 19242->19243 19244 41993a lstrcpynW 19242->19244 19245 419840 19243->19245 19244->19245 19245->19218 19246 40aa15 19245->19246 19247 40aa1e 19246->19247 19248 40aa2e 19246->19248 19249 40a2cc ctype 20 API calls 19247->19249 19248->19218 19249->19248 19251 40ab37 20 API calls 19250->19251 19252 40aa98 19251->19252 19253 40aaa3 GetCurrentProcess TerminateProcess 19252->19253 19256 40aab4 19252->19256 19253->19256 19254 40ab25 ExitProcess 19255 40ab1e 19257 40ab40 LeaveCriticalSection 19255->19257 19256->19254 19256->19255 19258 4097a6 19257->19258 19258->19156

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040338F
                                                                                          • LoadLibraryW.KERNELBASE(wtsapi32.dll,?), ref: 00403437
                                                                                          • GetProcAddress.KERNEL32(00000000,WTSRegisterSessionNotification), ref: 00403449
                                                                                          • Sleep.KERNEL32(000003E8), ref: 00403471
                                                                                          • LoadLibraryW.KERNELBASE(?), ref: 004034AB
                                                                                          • GetVersionExW.KERNEL32 ref: 004034C8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad$AddressFileModuleNameProcSleepVersion
                                                                                          • String ID: HKEY_CURRENT_USER\Control Panel\Mouse$MOSUE DRIVER V628M$SI-998-ShareData-Mutex-Object$WTSRegisterSessionNotification$config.ini$lan.dll$wtsapi32.dll
                                                                                          • API String ID: 2850616363-4232960622
                                                                                          • Opcode ID: b82381b0ad14ab9eeaccdadf912c0de99ca0cb599d2a54efc14ec4aa4a24a0b7
                                                                                          • Instruction ID: f315a66f8b1b6e68b24fe5d827fbe80a015eeb19b35a7e874da1d3e624824815
                                                                                          • Opcode Fuzzy Hash: b82381b0ad14ab9eeaccdadf912c0de99ca0cb599d2a54efc14ec4aa4a24a0b7
                                                                                          • Instruction Fuzzy Hash: 5C61B471244700ABD230ABB19C46FAF77ACDB94715F00893FF645A62D1DBBCA608876D

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • FindWindowW.USER32(00000000,MOSUE DRIVER V628M), ref: 004050D3
                                                                                          • IsIconic.USER32(00000000), ref: 004050E0
                                                                                          • ShowWindow.USER32(00000000,00000001), ref: 004050ED
                                                                                          • SetForegroundWindow.USER32(00000000), ref: 004050F4
                                                                                          • SetActiveWindow.USER32(00000000), ref: 004050FB
                                                                                          • GetModuleFileNameW.KERNEL32 ref: 00405137
                                                                                          • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00405177
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ActiveExecuteFileFindForegroundIconicModuleNameShellShow
                                                                                          • String ID: %s\Option.exe$MOSUE DRIVER V628M$open
                                                                                          • API String ID: 2919567187-2166052293
                                                                                          • Opcode ID: 898f454a6f98dd0c124515b8f36c7aa3588720126bcd54a7318958f7930ee091
                                                                                          • Instruction ID: 11101018dd20fea6efaa0bb9b16e99c858dc8dea9fc57b6ca4f93721e148af9b
                                                                                          • Opcode Fuzzy Hash: 898f454a6f98dd0c124515b8f36c7aa3588720126bcd54a7318958f7930ee091
                                                                                          • Instruction Fuzzy Hash: CE219F71284745ABE320EF10DC4AFDB77A4FB84B10F008A2DF565562D1DB7C54048BDA

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • LocalAlloc.KERNEL32(00000040,00000014,?,?,?,?,?,?), ref: 00404DB1
                                                                                          • InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,?,?,?,?,?), ref: 00404DC6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocDescriptorInitializeLocalSecurity
                                                                                          • String ID: SI-998-ShareData
                                                                                          • API String ID: 1029279785-3036073059
                                                                                          • Opcode ID: 2a8013ad181a2700ce94feb06bd6a812e4ffd2a6b09ba4d217709435a50dbb79
                                                                                          • Instruction ID: 74623bc1a9fedc9103f15ac9824e66902701dd91200edcbd30cc0fab543e5405
                                                                                          • Opcode Fuzzy Hash: 2a8013ad181a2700ce94feb06bd6a812e4ffd2a6b09ba4d217709435a50dbb79
                                                                                          • Instruction Fuzzy Hash: F911D3717803106BE2205B69BC49BDB7B58EB84B76F504176FB00DA2D0D3BD890D87E9

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 332 415e95-415ec0 call 40a1b8 GetFullPathNameW 335 415ec2-415ecf lstrcpynW 332->335 336 415ed4-415f03 call 415f65 GetVolumeInformationW 332->336 337 415f55-415f62 335->337 340 415f05-415f09 336->340 341 415f47-415f53 call 414f8d 336->341 342 415f12-415f16 340->342 343 415f0b-415f0c CharUpperW 340->343 341->337 345 415f44-415f46 342->345 346 415f18-415f2b FindFirstFileW 342->346 343->342 345->341 346->345 348 415f2d-415f3e FindClose lstrcpyW 346->348 348->345
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00415E9A
                                                                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00415EB8
                                                                                          • lstrcpynW.KERNEL32(?,?,00000104), ref: 00415EC7
                                                                                          • GetVolumeInformationW.KERNELBASE(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00415EFB
                                                                                          • CharUpperW.USER32(?), ref: 00415F0C
                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00415F22
                                                                                          • FindClose.KERNEL32(00000000), ref: 00415F2E
                                                                                          • lstrcpyW.KERNEL32(?,?), ref: 00415F3E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$CharCloseFileFirstFullH_prologInformationNamePathUpperVolumelstrcpylstrcpyn
                                                                                          • String ID:
                                                                                          • API String ID: 304730633-0
                                                                                          • Opcode ID: e52316f4fcb380b8524cf80e286e8ebc9cbb867caacd979fdebc5a3694b11813
                                                                                          • Instruction ID: cad89e647789040ea7deefd14efb65ab58fbcfc185681873e857c35ca28102b5
                                                                                          • Opcode Fuzzy Hash: e52316f4fcb380b8524cf80e286e8ebc9cbb867caacd979fdebc5a3694b11813
                                                                                          • Instruction Fuzzy Hash: FB214871900519BACB109F61DC4CAEF7F7CEF45764F10812AF829E61A0D7348A86CBA4
                                                                                          APIs
                                                                                          • SetWindowsHookExW.USER32(0000000D,Function_00001650,?,00000000), ref: 004016EF
                                                                                          • wsprintfW.USER32 ref: 00401705
                                                                                          • OutputDebugStringW.KERNELBASE(00000000), ref: 00401713
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DebugHookOutputStringWindowswsprintf
                                                                                          • String ID: Hhook: %x
                                                                                          • API String ID: 3801522495-986256327
                                                                                          • Opcode ID: 085ec6f3adff073eced114873163c16395301489ebbef4cb11db0f79a493dd32
                                                                                          • Instruction ID: a178b230e2de684d89aeb8ceefabfa7731d82ea551c8591fbe6764577f4f13c1
                                                                                          • Opcode Fuzzy Hash: 085ec6f3adff073eced114873163c16395301489ebbef4cb11db0f79a493dd32
                                                                                          • Instruction Fuzzy Hash: DAF082B85403019BD3149B50FD0AB6637A8EB89300F05843DF905C62A2D77C98148B99
                                                                                          APIs
                                                                                          • CoInitialize.OLE32(00000000), ref: 00404D15
                                                                                          • #17.COMCTL32(?,00403380), ref: 00404D1B
                                                                                          • CoCreateInstance.OLE32(0041D1F8,00000000,00000015,0041D208,?,?,00403380), ref: 00404D33
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateInitializeInstance
                                                                                          • String ID:
                                                                                          • API String ID: 3519745914-0
                                                                                          • Opcode ID: d0b05c3a4c1c80e167c7ec3688992449c31c883ac8af7ad7733c3702411b9612
                                                                                          • Instruction ID: 75c62bf325b150053c6021bd3de0a4f6417ce5aea1d67f7f89707a73954a442c
                                                                                          • Opcode Fuzzy Hash: d0b05c3a4c1c80e167c7ec3688992449c31c883ac8af7ad7733c3702411b9612
                                                                                          • Instruction Fuzzy Hash: 4BD0A7B178162067E21413289C0FFCA2B58CF08B56F11C176B913E90D1DBE4684045EC

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                            • Part of subcall function 004062E0: RegOpenKeyExW.KERNELBASE(?,?,00000000,000F003F,?,?,?,?,00407A92,80000001,?,?,?,Control Panel\Mouse), ref: 004062F9
                                                                                            • Part of subcall function 004062E0: RegCreateKeyW.ADVAPI32(?,?,?), ref: 0040630A
                                                                                          • wsprintfW.USER32 ref: 00406974
                                                                                          • wsprintfW.USER32 ref: 0040699B
                                                                                          • wsprintfW.USER32 ref: 004069C2
                                                                                          • wsprintfW.USER32 ref: 00406A14
                                                                                          • wsprintfW.USER32 ref: 00406A3B
                                                                                          • wsprintfW.USER32 ref: 00406A62
                                                                                          • RegCloseKey.KERNELBASE(?), ref: 00406A86
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: wsprintf$CloseCreateOpen
                                                                                          • String ID: Control Panel\Desktop$Control Panel\Mouse$DoubleClickSpeed$MouseSensitivity$MouseSpeed$MouseThreshold1$MouseThreshold2$SwapMouseButtons$WheelScrollLines
                                                                                          • API String ID: 1131821687-3657349053
                                                                                          • Opcode ID: b0f6ca1c856f1b86a6d07ebc47bba52d7669f4f83a52246b7ff2db594c38dabd
                                                                                          • Instruction ID: ac21320dcbaaeb6485cbacb33c2e25626a926aed3c9424f89b013bc07c0a5167
                                                                                          • Opcode Fuzzy Hash: b0f6ca1c856f1b86a6d07ebc47bba52d7669f4f83a52246b7ff2db594c38dabd
                                                                                          • Instruction Fuzzy Hash: B951E4B17003056BD604EB24DC81EBF73A8EFD4704F41893EFA45A7191E678E919CBA9

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 102 41278c-4127ab call 419175 105 4127c4-4127e2 call 4189d1 102->105 106 4127ad-4127bf CallNextHookEx 102->106 110 4127e8-4127ef 105->110 111 41287c-41289f call 412515 105->111 107 412877-412879 106->107 113 4127f1-4127f3 110->113 114 41284f-412864 CallNextHookEx 110->114 126 4128a1-4128a5 111->126 127 412914-412927 call 4125ab SetWindowLongW 111->127 113->114 118 4127f5-412803 GetWindowLongW 113->118 115 412873-412876 114->115 116 412866-41286f UnhookWindowsHookEx 114->116 115->107 116->115 118->114 119 412805-412814 GetPropW 118->119 119->114 121 412816-41282c SetPropW GetPropW 119->121 121->114 122 41282e-41283e GlobalAddAtomW 121->122 124 412840 122->124 125 412845-412849 SetWindowLongW 122->125 124->125 125->114 126->127 129 4128a7-4128af 126->129 133 412929-41292e 127->133 134 412908-41290c 127->134 131 412911 129->131 132 4128b1-4128b5 129->132 131->127 132->131 135 4128b7-4128cc call 41230f 132->135 133->134 134->114 135->131 138 4128ce-4128f2 call 4125ab GetWindowLongW 135->138 142 412905 138->142 143 4128f4-412903 SetWindowLongW 138->143 142->134 143->142
                                                                                          APIs
                                                                                            • Part of subcall function 00419175: TlsGetValue.KERNEL32(004465C0,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26,?,00000000,?,004115DF,00000000,00000000,00000000,00000000), ref: 004191B4
                                                                                          • CallNextHookEx.USER32(?,00000003,?,?), ref: 004127B9
                                                                                          • GetWindowLongW.USER32(?,000000FC), ref: 004127F8
                                                                                          • GetPropW.USER32(?,AfxOldWndProc423), ref: 0041280C
                                                                                          • SetPropW.USER32(?,AfxOldWndProc423,00000003), ref: 0041281B
                                                                                          • GetPropW.USER32(?,AfxOldWndProc423), ref: 00412823
                                                                                          • GlobalAddAtomW.KERNEL32(AfxOldWndProc423), ref: 0041282F
                                                                                          • SetWindowLongW.USER32(?,000000FC,Function_00012710), ref: 00412849
                                                                                          • CallNextHookEx.USER32(?,00000003,?,?), ref: 00412858
                                                                                          • UnhookWindowsHookEx.USER32(?), ref: 00412869
                                                                                          • GetWindowLongW.USER32(?,000000FC), ref: 004128D9
                                                                                          • SetWindowLongW.USER32(?,000000FC,00000000), ref: 004128FA
                                                                                          • SetWindowLongW.USER32(?,000000FC,00000000), ref: 0041291F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: LongWindow$HookProp$CallNext$AtomGlobalUnhookValueWindows
                                                                                          • String ID: AfxOldWndProc423
                                                                                          • API String ID: 3289694481-1060338832
                                                                                          • Opcode ID: 02d4a88e8890e7db5cde7377321e9bb617770c236556bb532163fa009f90813d
                                                                                          • Instruction ID: 7cfaa200ac017a5c23e22ac054a59d0304d31899c623ff95e55bdaf0a0c1b1a5
                                                                                          • Opcode Fuzzy Hash: 02d4a88e8890e7db5cde7377321e9bb617770c236556bb532163fa009f90813d
                                                                                          • Instruction Fuzzy Hash: 8751A671600114BBCF119F65DD88BEE3B75FF09754F10816AFC15DA2A1C7788AA0CB98

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040596D
                                                                                          • LoadLibraryW.KERNELBASE(?), ref: 004059CC
                                                                                          • GetLastError.KERNEL32 ref: 004059D9
                                                                                            • Part of subcall function 00414F8D: InterlockedDecrement.KERNEL32(-000000F4), ref: 00414FA1
                                                                                          • GetProcAddress.KERNEL32(?,installmousehook), ref: 00405A2F
                                                                                          • GetProcAddress.KERNEL32(?,removemousehook), ref: 00405A3D
                                                                                          • GetProcAddress.KERNEL32(?,enablemousehook), ref: 00405A4B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$DecrementErrorFileInterlockedLastLibraryLoadModuleName
                                                                                          • String ID: GetError:%d$KBHook$dll$enablemousehook$installmousehook$removemousehook
                                                                                          • API String ID: 2491502672-1306770188
                                                                                          • Opcode ID: 2cc106ccd2377acb16916b8b2f6d07c97b19047db3e495b34d4d236ee56e843e
                                                                                          • Instruction ID: 628d02777a48840909c644a42b9e88d5eb58ebdbd750f1b8e153162314f6fe73
                                                                                          • Opcode Fuzzy Hash: 2cc106ccd2377acb16916b8b2f6d07c97b19047db3e495b34d4d236ee56e843e
                                                                                          • Instruction Fuzzy Hash: 1931A1B1244340ABD334DF65D885FDBB3E8FB98710F044A2EB249836A0E7B8A544CB56

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                            • Part of subcall function 004062E0: RegOpenKeyExW.KERNELBASE(?,?,00000000,000F003F,?,?,?,?,00407A92,80000001,?,?,?,Control Panel\Mouse), ref: 004062F9
                                                                                            • Part of subcall function 004062E0: RegCreateKeyW.ADVAPI32(?,?,?), ref: 0040630A
                                                                                          • RegCloseKey.KERNELBASE(?), ref: 00407BAC
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateOpen
                                                                                          • String ID: Control Panel\Desktop$Control Panel\Mouse$DoubleClickSpeed$MouseSensitivity$MouseSpeed$MouseThreshold1$MouseThreshold2$WheelScrollLines
                                                                                          • API String ID: 199004384-4240905876
                                                                                          • Opcode ID: a8b77e11986ddd11b6ff42c428276f0be06f1bd72664291f3f39ea84b5121a40
                                                                                          • Instruction ID: d7501d60ed66c056186de7431bc7770dfdd43c8ed8805e664fefd986742d9185
                                                                                          • Opcode Fuzzy Hash: a8b77e11986ddd11b6ff42c428276f0be06f1bd72664291f3f39ea84b5121a40
                                                                                          • Instruction Fuzzy Hash: 4E41A6716047005FD314EB21DC81EABB3E9EBC4314F548A3FFA5592281D77CE9098B56

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 202 408c70-408c8c lstrlenW 203 408c9e-408ca0 202->203 204 408c8e 202->204 206 408ca2-408ca9 203->206 207 408cac-408ccd lstrcpynW lstrcmpiW 203->207 205 408c90-408c94 204->205 205->203 210 408c96-408c9c 205->210 208 408cf9-408d07 lstrcmpiW 207->208 209 408ccf-408cd3 207->209 212 408d16-408d24 lstrcmpiW 208->212 213 408d09-408d14 208->213 211 408cda-408cf6 lstrcpynW 209->211 210->203 210->205 214 408d33-408d41 lstrcmpiW 212->214 215 408d26-408d31 212->215 213->211 216 408d50-408d71 lstrcpyW 214->216 217 408d43-408d4e 214->217 215->211 217->211
                                                                                          APIs
                                                                                          • lstrlenW.KERNEL32(?,?,00000114,00000000,?,00000114,00408D95,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408C80
                                                                                          • lstrcpynW.KERNEL32(0000010C,?,00000001,?,00000114,00000000,?,00000114,00408D95,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408CB9
                                                                                          • lstrcmpiW.KERNELBASE(0000010C,HKEY_LOCAL_MACHINE,?,00000114,00000000,?,00000114,00408D95,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408CC5
                                                                                          • lstrcpynW.KERNEL32(0000010C,?,00000000,?,00000114,00000000,?,00000114,00408D95,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408CE6
                                                                                          • lstrcmpiW.KERNEL32(0000010C,HKEY_CURRENT_USER,?,00000114,00000000,?,00000114,00408D95,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408CFF
                                                                                          • lstrcmpiW.KERNEL32(0000010C,HKEY_CURRENT_CONFIG,?,00000114,00000000,?,00000114,00408D95,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408D1C
                                                                                          • lstrcmpiW.KERNEL32(0000010C,HKEY_CLASSES_ROOT,?,00000114,00000000,?,00000114,00408D95,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408D39
                                                                                          • lstrcpyW.KERNEL32(0000010C,?,?,00000114,00000000,?,00000114,00408D95,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408D61
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: lstrcmpi$lstrcpyn$lstrcpylstrlen
                                                                                          • String ID: HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE
                                                                                          • API String ID: 2229470203-671311287
                                                                                          • Opcode ID: 769b91789266db7b7a2c73e2e94f051f4a8d5ba0a71f63cdfea4399f8be828a2
                                                                                          • Instruction ID: f85edf39c18904b0c741b05614c1e9d9e99f5628c770a7f44e85a478f441eb3d
                                                                                          • Opcode Fuzzy Hash: 769b91789266db7b7a2c73e2e94f051f4a8d5ba0a71f63cdfea4399f8be828a2
                                                                                          • Instruction Fuzzy Hash: 4431C272249312ABE300CF16EE48AABB768FFA0345F11843EF54193250CB799846C6AD

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                            • Part of subcall function 00409E4A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000014,00000000,00000000), ref: 00409E61
                                                                                            • Part of subcall function 00408E00: RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,00403102,MouseSpeed), ref: 00408E32
                                                                                          • wsprintfW.USER32 ref: 004031E7
                                                                                          • SystemParametersInfoW.USER32(00000004,00000000,?,00000002), ref: 0040323D
                                                                                          • GetLastError.KERNEL32 ref: 00403243
                                                                                          • PostMessageW.USER32(?,0000001A,00000004,?), ref: 0040325C
                                                                                          • SystemParametersInfoW.USER32(00000071,00000000,?,00000002), ref: 0040326B
                                                                                          • GetLastError.KERNEL32 ref: 00403271
                                                                                          • PostMessageW.USER32(?,0000001A,00000071,00000000), ref: 00403281
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorInfoLastMessageParametersPostSystem$ByteCharMultiQueryValueWidewsprintf
                                                                                          • String ID: MouseSpeed$MouseThreshold1$MouseThreshold2
                                                                                          • API String ID: 974871492-269452792
                                                                                          • Opcode ID: 2f5764da3341c9e43c2f4949fa7f8710027ae9f77f8114f6c85a7d8b559af210
                                                                                          • Instruction ID: 7a9340b87b8d89210827ef5cab90a701dccdba5b86efdb5ebf993a960ab80c62
                                                                                          • Opcode Fuzzy Hash: 2f5764da3341c9e43c2f4949fa7f8710027ae9f77f8114f6c85a7d8b559af210
                                                                                          • Instruction Fuzzy Hash: 5941F7B1300301ABE714DF54DC51FAF7399EBD8704F40493EB641A62D1DBB8AA498B9A

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 245 4014b0-40150d wsprintfW call 40986d call 409c9f 250 401521-401541 CreateMutexW GetLastError 245->250 251 40150f-401515 245->251 253 401593-4015b1 call 414cc6 250->253 254 401543-401557 CloseHandle 250->254 251->250 252 401517 251->252 252->250 259 4015b3-4015bc call 402df0 253->259 260 4015be 253->260 255 401579-401592 254->255 256 401559-401573 FindWindowW PostMessageW 254->256 256->255 262 4015c0-4015d3 call 402ee0 259->262 260->262 265 4015d8-4015fc 262->265
                                                                                          APIs
                                                                                          • wsprintfW.USER32 ref: 004014DD
                                                                                          • CreateMutexW.KERNELBASE(00000000,00000000,SI-998_HidHost_Mutex), ref: 0040152A
                                                                                          • GetLastError.KERNEL32 ref: 00401536
                                                                                          • CloseHandle.KERNEL32(?), ref: 0040154A
                                                                                          • FindWindowW.USER32(00000000,Ghost Queen_Gaming_Mouse_Normal_Monitor), ref: 00401560
                                                                                          • PostMessageW.USER32(00000000,00000111,00001771,00000000), ref: 00401573
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateErrorFindHandleLastMessageMutexPostWindowwsprintf
                                                                                          • String ID: 1$CMonitorApp: %s$Ghost Queen_Gaming_Mouse_Normal_Monitor$SI-998_HidHost_Mutex
                                                                                          • API String ID: 4134591505-2967982488
                                                                                          • Opcode ID: 010522ef43730029891de78eb4291ac18695229fa81a5192db8786fb8bd3cae5
                                                                                          • Instruction ID: 08ab38722d48a3ea24ed0b3c4ad9c8df306c9db72d8975e5652a9deed374e310
                                                                                          • Opcode Fuzzy Hash: 010522ef43730029891de78eb4291ac18695229fa81a5192db8786fb8bd3cae5
                                                                                          • Instruction Fuzzy Hash: A4318F75A04700ABE7209B74DC4AF9A77E4FB84710F008A3EF556A73E1D7B89404CB95

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 004125B6
                                                                                          • GetPropW.USER32(?,AfxOldWndProc423), ref: 004125CE
                                                                                          • CallWindowProcW.USER32(?,?,00000110,?,00000000), ref: 0041262C
                                                                                            • Part of subcall function 004121BF: GetWindowRect.USER32(?,?), ref: 004121E4
                                                                                            • Part of subcall function 004121BF: GetWindow.USER32(?,00000004), ref: 00412201
                                                                                          • SetWindowLongW.USER32(?,000000FC,?), ref: 0041265C
                                                                                          • RemovePropW.USER32(?,AfxOldWndProc423), ref: 00412664
                                                                                          • GlobalFindAtomW.KERNEL32(AfxOldWndProc423), ref: 0041266B
                                                                                          • GlobalDeleteAtom.KERNEL32(00000000), ref: 00412672
                                                                                            • Part of subcall function 0041219C: GetWindowRect.USER32(?,?), ref: 004121A8
                                                                                          • CallWindowProcW.USER32(?,?,?,?,00000000), ref: 004126C6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
                                                                                          • String ID: AfxOldWndProc423
                                                                                          • API String ID: 2397448395-1060338832
                                                                                          • Opcode ID: 575124a5b202eabb01c0d8a8824dee8b8283b490ffae5a2a13874a11ca85b6d1
                                                                                          • Instruction ID: 599d294915b37d2bfdfc0dd106917896d2ac71c1b5c25f60885aff762a4ee13f
                                                                                          • Opcode Fuzzy Hash: 575124a5b202eabb01c0d8a8824dee8b8283b490ffae5a2a13874a11ca85b6d1
                                                                                          • Instruction Fuzzy Hash: 1E31613290011ABBCF01AFA5DE49EFF7B78EF09354F00412AF901E2150C7B949B19BA9

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 304 418e0e-418e2b EnterCriticalSection 305 418e3a-418e3f 304->305 306 418e2d-418e34 304->306 308 418e41-418e44 305->308 309 418e5c-418e65 305->309 306->305 307 418ef3-418ef6 306->307 310 418ef8-418efb 307->310 311 418efe-418f1f LeaveCriticalSection 307->311 312 418e47-418e4a 308->312 313 418e67-418e78 GlobalAlloc 309->313 314 418e7a-418e96 GlobalHandle GlobalUnlock GlobalReAlloc 309->314 310->311 316 418e54-418e56 312->316 317 418e4c-418e52 312->317 315 418e9c-418ea8 313->315 314->315 318 418ec5-418ef2 GlobalLock call 40a160 315->318 319 418eaa-418ec0 GlobalHandle GlobalLock LeaveCriticalSection call 4119a4 315->319 316->307 316->309 317->312 317->316 318->307 319->318
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(004465DC,004460F8,00000000,?,004465C0,004465C0,004191A9,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26,?,00000000), ref: 00418E1D
                                                                                          • GlobalAlloc.KERNELBASE(00002002,00000000,?,?,004465C0,004465C0,004191A9,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26,?,00000000), ref: 00418E72
                                                                                          • GlobalHandle.KERNEL32(00621FB0), ref: 00418E7B
                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00418E84
                                                                                          • GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 00418E96
                                                                                          • GlobalHandle.KERNEL32(00621FB0), ref: 00418EAD
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00418EB4
                                                                                          • LeaveCriticalSection.KERNEL32(0040979D,?,?,004465C0,004465C0,004191A9,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26,?,00000000), ref: 00418EBA
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00418EC9
                                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 00418F12
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
                                                                                          • String ID:
                                                                                          • API String ID: 2667261700-0
                                                                                          • Opcode ID: ba93c9528b9092bcec38de35a6ed512f6bca5dff0015601edf65476bdfd45abd
                                                                                          • Instruction ID: 3c8cfeecc1e812482b5a4b10709007fd9ee850707cdf2a79a2fa5dd476b0f063
                                                                                          • Opcode Fuzzy Hash: ba93c9528b9092bcec38de35a6ed512f6bca5dff0015601edf65476bdfd45abd
                                                                                          • Instruction Fuzzy Hash: 6F31A4756007099FD7209F28DC89AABB7E9FF44304B01492EF966C3661EB75EC448B58

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • KiUserCallbackDispatcher.NTDLL(0000000B), ref: 004163F1
                                                                                          • GetSystemMetrics.USER32(0000000C), ref: 004163F8
                                                                                          • GetDC.USER32(00000000), ref: 00416411
                                                                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 00416422
                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041642A
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00416432
                                                                                            • Part of subcall function 004193BF: GetSystemMetrics.USER32(00000002), ref: 004193D1
                                                                                            • Part of subcall function 004193BF: GetSystemMetrics.USER32(00000003), ref: 004193DB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
                                                                                          • String ID:
                                                                                          • API String ID: 1031845853-0
                                                                                          • Opcode ID: b0027c4f17320a05d4d5c9381b1cc754e649176484330b83374ec509d334970f
                                                                                          • Instruction ID: 8ee29b798300e3a78f1404af6406519d759fbbe7d0ae85584adaac5aeadd5949
                                                                                          • Opcode Fuzzy Hash: b0027c4f17320a05d4d5c9381b1cc754e649176484330b83374ec509d334970f
                                                                                          • Instruction Fuzzy Hash: CFF0B4306407049BE2206B72CC49F9B77A4EB84B52F01842EE611472D1CBB49C458FA9
                                                                                          APIs
                                                                                          • SystemParametersInfoW.USER32(00000069,00000000,00000000,00000002), ref: 004032CF
                                                                                          • GetLastError.KERNEL32(?,?,00403097,?,00403046,00000000,004339D8), ref: 004032D9
                                                                                          • PostMessageW.USER32(?,0000001A,00000069,00000000), ref: 004032E9
                                                                                          • BroadcastSystemMessageW.USER32(00000008,?,0000001A,00000069,WheelScrollLines), ref: 00403307
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSystem$BroadcastErrorInfoLastParametersPost
                                                                                          • String ID: WheelScrollLines
                                                                                          • API String ID: 912762770-361151373
                                                                                          • Opcode ID: 963b502109a4a53689bfe7811ca8872fa7064c04594bbc389c7f7bf6e62d64fc
                                                                                          • Instruction ID: 12f27255adead2f594cbcb8db217b451c692dd495cda7ab1b9685fff3cc80047
                                                                                          • Opcode Fuzzy Hash: 963b502109a4a53689bfe7811ca8872fa7064c04594bbc389c7f7bf6e62d64fc
                                                                                          • Instruction Fuzzy Hash: EC01DF30340205AFE724CF14DC49FA637A8FB54B06F50817EF112EA1E1DBF0AA298B48
                                                                                          APIs
                                                                                          • LoadIconW.USER32(?,00000080), ref: 00403628
                                                                                          • LoadStringW.USER32 ref: 00403663
                                                                                          • Shell_NotifyIconW.SHELL32(00000000), ref: 00403685
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: IconLoad$NotifyShell_String
                                                                                          • String ID: f
                                                                                          • API String ID: 29320856-1993550816
                                                                                          • Opcode ID: ebef8a0706fa83c8fb4131610acdcfd2c7739ebff0a6c9d917c57d3c0df2020b
                                                                                          • Instruction ID: 7970e5ac18666f277da37e852a1632deb24dcea83c25d1c4b2f502c0f1194e4f
                                                                                          • Opcode Fuzzy Hash: ebef8a0706fa83c8fb4131610acdcfd2c7739ebff0a6c9d917c57d3c0df2020b
                                                                                          • Instruction Fuzzy Hash: A7016DF0518345AFE710DF50C849B9BB7E8FF84708F008A1DF58897291EB7896198B9A
                                                                                          APIs
                                                                                          • GetVersion.KERNEL32(?,?,?,0041939A), ref: 00419416
                                                                                          • GetProcessVersion.KERNELBASE(00000000,?,?,?,0041939A), ref: 00419453
                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00419481
                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 0041948C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CursorLoadVersion$Process
                                                                                          • String ID:
                                                                                          • API String ID: 2246821583-0
                                                                                          • Opcode ID: 49bf3d268fca677be6336790979a6d82727b460b1daefaac1bddcd676555a6b8
                                                                                          • Instruction ID: 5cdfe9482644c7302b6e6ec66a10a86b2815ed8fd950704b22c92632f5a335d0
                                                                                          • Opcode Fuzzy Hash: 49bf3d268fca677be6336790979a6d82727b460b1daefaac1bddcd676555a6b8
                                                                                          • Instruction Fuzzy Hash: D3114CB1A047608FD724DF3A889466ABBE5FB487047414D3FE18BC6B91D778E441CB94
                                                                                          APIs
                                                                                          • HeapReAlloc.KERNEL32(00000000,00000060,00000000,00000000,0040DD58,00000000,?,?,?,0040972E), ref: 0040DFB8
                                                                                          • HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0040DD58,00000000,?,?,?,0040972E), ref: 0040DFEC
                                                                                          • VirtualAlloc.KERNELBASE(00000000,00100000,00002000,00000004,?,0040972E), ref: 0040E006
                                                                                          • HeapFree.KERNEL32(00000000,?,?,0040972E), ref: 0040E01D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeap$FreeVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 3499195154-0
                                                                                          • Opcode ID: 02c5f6202945efccf806d3ab3a04997ffc27b33b5e0410dcb1ea71f79d2b3c5c
                                                                                          • Instruction ID: c1b1e39bf15ad2690636aa747268f7a108d4363124d403247d6bc416946d1563
                                                                                          • Opcode Fuzzy Hash: 02c5f6202945efccf806d3ab3a04997ffc27b33b5e0410dcb1ea71f79d2b3c5c
                                                                                          • Instruction Fuzzy Hash: 54113A34200301AFD7308F19EC45D667BB6FB8A7507114A3EF5A2D61F0D371A81ACB59
                                                                                          APIs
                                                                                          • HeapReAlloc.KERNEL32(00000000,00000060,00000000,00000000,021B408A,00000000,?,?,?,021B149E), ref: 021B42EA
                                                                                          • HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,021B408A,00000000,?,?,?,021B149E), ref: 021B431E
                                                                                          • VirtualAlloc.KERNELBASE(00000000,00100000,00002000,00000004), ref: 021B4338
                                                                                          • HeapFree.KERNEL32(00000000,?), ref: 021B434F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeap$FreeVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 3499195154-0
                                                                                          • Opcode ID: fb287551f932e70ccfd21a3d7d8da1e9cb9d9d96eee503243473f19685842962
                                                                                          • Instruction ID: ab1a00edfb5afa26d1192d52b68e073a4fdd9e4a4a73601f9037aa8292e2f76a
                                                                                          • Opcode Fuzzy Hash: fb287551f932e70ccfd21a3d7d8da1e9cb9d9d96eee503243473f19685842962
                                                                                          • Instruction Fuzzy Hash: 3B116D30A80201DFD7239F29FC45A677BF9FB44B547154E19F266C21A0C331A4A6CF50
                                                                                          APIs
                                                                                          • KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00415A24
                                                                                          • TranslateMessage.USER32(?), ref: 00415A44
                                                                                          • DispatchMessageW.USER32(?), ref: 00415A4B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message$CallbackDispatchDispatcherTranslateUser
                                                                                          • String ID:
                                                                                          • API String ID: 2960505505-0
                                                                                          • Opcode ID: 085aec0ad17ef420c2da831ce20dcfa4031d86ffbefef1519d6bc0373861c2f4
                                                                                          • Instruction ID: 4fbf26042204780afb813040fca5284d6c1322c34ab26a45c965801c0c1c6f6d
                                                                                          • Opcode Fuzzy Hash: 085aec0ad17ef420c2da831ce20dcfa4031d86ffbefef1519d6bc0373861c2f4
                                                                                          • Instruction Fuzzy Hash: F8E09232350500AFD7215B65AC8CDFF37ECEFC1B41700542EF941C6110C764EC858AA9
                                                                                          APIs
                                                                                          • RegQueryValueExW.KERNELBASE ref: 0040634E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: QueryValue
                                                                                          • String ID: P
                                                                                          • API String ID: 3660427363-3110715001
                                                                                          • Opcode ID: 40d54753af4da6c2f1a4aae74cb1083db9f3346faf9f160e431523164f79ec7c
                                                                                          • Instruction ID: dc013389b2df2ebaab61c3b56668aaa2d180508f0e9eb1ccf67cc40e7cfcc691
                                                                                          • Opcode Fuzzy Hash: 40d54753af4da6c2f1a4aae74cb1083db9f3346faf9f160e431523164f79ec7c
                                                                                          • Instruction Fuzzy Hash: 48E0B6B0108307AFD604DF44ED44B6BBBE8ABC8709F40891CF58896140D270A90C8BB7
                                                                                          APIs
                                                                                            • Part of subcall function 00415E95: __EH_prolog.LIBCMT ref: 00415E9A
                                                                                            • Part of subcall function 00415E95: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00415EB8
                                                                                            • Part of subcall function 00415E95: lstrcpynW.KERNEL32(?,?,00000104), ref: 00415EC7
                                                                                          • CreateFileW.KERNELBASE(00000000,80000000,00000000,0000000C,00000003,00000080,00000000,?,?,00000000), ref: 00415C44
                                                                                          • GetLastError.KERNEL32 ref: 00415C56
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateErrorFileFullH_prologLastNamePathlstrcpyn
                                                                                          • String ID:
                                                                                          • API String ID: 1034715445-0
                                                                                          • Opcode ID: f8a22d38e6b8cbe08ed8b4c2f9041c66586826e104b1611ee113e43c97ceabae
                                                                                          • Instruction ID: 013ce217602706c1410a147fe64d26d855764935ede7e5a221831fab63577127
                                                                                          • Opcode Fuzzy Hash: f8a22d38e6b8cbe08ed8b4c2f9041c66586826e104b1611ee113e43c97ceabae
                                                                                          • Instruction Fuzzy Hash: 3531D632A04B09DBEB204F25CC45BEB76A5EBC0714F20852BE416D62D0D67CE9C58798
                                                                                          APIs
                                                                                          • wsprintfW.USER32 ref: 0040132B
                                                                                          • WritePrivateProfileStringW.KERNEL32(?,?,?), ref: 0040134C
                                                                                            • Part of subcall function 00414F8D: InterlockedDecrement.KERNEL32(-000000F4), ref: 00414FA1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfileStringWritewsprintf
                                                                                          • String ID:
                                                                                          • API String ID: 3064552202-0
                                                                                          • Opcode ID: 1aac19408c4ede6f181b24bd6851efd7c61b6c2c1377bd125540434b769ea7ab
                                                                                          • Instruction ID: 112b4c024916d71f94a3b8626adcb98a287bd75764990d430d49e186babd0024
                                                                                          • Opcode Fuzzy Hash: 1aac19408c4ede6f181b24bd6851efd7c61b6c2c1377bd125540434b769ea7ab
                                                                                          • Instruction Fuzzy Hash: 860144B55483519BC334DF54D949FEAB7E8EB98720F108A1DB869833C1D7385805CBA6
                                                                                          APIs
                                                                                            • Part of subcall function 00408E50: RegCloseKey.ADVAPI32(00000000,00000114,00408D89,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408E5A
                                                                                            • Part of subcall function 00408C70: lstrlenW.KERNEL32(?,?,00000114,00000000,?,00000114,00408D95,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408C80
                                                                                          • RegOpenKeyExW.KERNELBASE(?,0000011C,00000000,?,00000114,?,?,?,004034E0,HKEY_CURRENT_USER\Control Panel\Mouse,000F003F), ref: 00408DA5
                                                                                          • RegCreateKeyW.ADVAPI32(?,0000011C,00000114), ref: 00408DB5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateOpenlstrlen
                                                                                          • String ID:
                                                                                          • API String ID: 3878153324-0
                                                                                          • Opcode ID: b193e532e4995cbd9fcc970b5767062cdac57dd55023ec277702e0dec8efa3e5
                                                                                          • Instruction ID: 68316801793f24acb710a74fd0ac5afaac1d27ffae19efdbc95752d551638a7f
                                                                                          • Opcode Fuzzy Hash: b193e532e4995cbd9fcc970b5767062cdac57dd55023ec277702e0dec8efa3e5
                                                                                          • Instruction Fuzzy Hash: D5F082323002106BD230EA26ED08E87ABACEFE5B10F008C2EF495D7290CA74E841C7B4
                                                                                          APIs
                                                                                          • SetErrorMode.KERNELBASE(00000000,00000000,00416C45,00000000,00000000,00000000,00000000,?,00000000,?,004115DF,00000000,00000000,00000000,00000000,0040979D), ref: 00419784
                                                                                          • SetErrorMode.KERNELBASE(00000000,?,00000000,?,004115DF,00000000,00000000,00000000,00000000,0040979D,00000000), ref: 0041978B
                                                                                            • Part of subcall function 004197DE: GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 0041980F
                                                                                            • Part of subcall function 004197DE: lstrcpyW.KERNEL32(?,.HLP,?,?,00000104), ref: 004198B0
                                                                                            • Part of subcall function 004197DE: lstrcatW.KERNEL32(?,.INI,?,?,00000104), ref: 004198DF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
                                                                                          • String ID:
                                                                                          • API String ID: 3389432936-0
                                                                                          • Opcode ID: 52a994d05a2c644751cbf17547c16b6b43574b429ee90136f86cb0c9dfa3ac04
                                                                                          • Instruction ID: 08abe220318264bac5dfd8fd1e4b3746e68b3a1549190df0ca85074819778a31
                                                                                          • Opcode Fuzzy Hash: 52a994d05a2c644751cbf17547c16b6b43574b429ee90136f86cb0c9dfa3ac04
                                                                                          • Instruction Fuzzy Hash: D4F04FB59282148FD714EF25D454B9A7BD4AF48710F05848FF4549B3A2CB78D880CB5A
                                                                                          APIs
                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000,1000102F,00000001), ref: 10001C31
                                                                                            • Part of subcall function 10001AD8: GetVersionExA.KERNEL32 ref: 10001AF7
                                                                                          • HeapDestroy.KERNEL32 ref: 10001C70
                                                                                            • Part of subcall function 10002F9F: HeapAlloc.KERNEL32(00000000,00000140,10001C59,000003F8), ref: 10002FAC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$AllocCreateDestroyVersion
                                                                                          • String ID:
                                                                                          • API String ID: 2507506473-0
                                                                                          • Opcode ID: da420c6330123c59e1a89b109059e27f15b6f2b99309323ebf8184ad9befd18e
                                                                                          • Instruction ID: 5930d5e70ddeffda98b18b61b0883d1abcb2f67c31d1ad2629e8852eb34db7a1
                                                                                          • Opcode Fuzzy Hash: da420c6330123c59e1a89b109059e27f15b6f2b99309323ebf8184ad9befd18e
                                                                                          • Instruction Fuzzy Hash: 6FF0EDB46983139AFB10EB314C86FAA36D9EB447D2F118435F544C81EDEBB1D9C19B12
                                                                                          APIs
                                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 00412D22
                                                                                          • CallWindowProcW.USER32(?,?,?,?,?), ref: 00412D37
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ProcWindow$Call
                                                                                          • String ID:
                                                                                          • API String ID: 2316559721-0
                                                                                          • Opcode ID: 6c9a7387255bd0908e23baf598cea651a2994c58611c9cc0640412986b03dbb0
                                                                                          • Instruction ID: 5731fb5630604108aed76506151130f3338f4d8c0b0942636815d9ee10b6b8a2
                                                                                          • Opcode Fuzzy Hash: 6c9a7387255bd0908e23baf598cea651a2994c58611c9cc0640412986b03dbb0
                                                                                          • Instruction Fuzzy Hash: C6F0A536100208EFDF229F95EC08EDABBB9FF18351B048529FA55C6120D776D971AB94
                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004154CD
                                                                                          • SetWindowsHookExW.USER32(000000FF,0041580F,00000000,00000000), ref: 004154DD
                                                                                            • Part of subcall function 0041920A: __EH_prolog.LIBCMT ref: 0041920F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentH_prologHookThreadWindows
                                                                                          • String ID:
                                                                                          • API String ID: 2183259885-0
                                                                                          • Opcode ID: 613918326cd70f2470d2d5451b8a3de32bc68ef1cc268844cd7e218a0473b699
                                                                                          • Instruction ID: 58f163234a68bd5265826fa023f781aa1a87d76f6f5462f608bf75149f782916
                                                                                          • Opcode Fuzzy Hash: 613918326cd70f2470d2d5451b8a3de32bc68ef1cc268844cd7e218a0473b699
                                                                                          • Instruction Fuzzy Hash: 44F0A072500A40BAD7243B70AD1DBDA7661AB41314F154A6FF112561E6CF7C88C183AE
                                                                                          APIs
                                                                                            • Part of subcall function 00419175: TlsGetValue.KERNEL32(004465C0,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26,?,00000000,?,004115DF,00000000,00000000,00000000,00000000), ref: 004191B4
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00412952
                                                                                          • SetWindowsHookExW.USER32(00000005,Function_0001278C,00000000,00000000), ref: 00412962
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentHookThreadValueWindows
                                                                                          • String ID:
                                                                                          • API String ID: 933525246-0
                                                                                          • Opcode ID: 7f90c48d9444cfb6f1bd1963790384d6de1d119bf8cd33a77089053909cb0cf5
                                                                                          • Instruction ID: 7b9088044dee1ef2855d2974d2eff7d99cebe4e7506a089451d8048f4fbb6980
                                                                                          • Opcode Fuzzy Hash: 7f90c48d9444cfb6f1bd1963790384d6de1d119bf8cd33a77089053909cb0cf5
                                                                                          • Instruction Fuzzy Hash: F1E0E571340700AED3349F165D047D776B4DBC0711F00862FE149C2141C7B45885CF6E
                                                                                          APIs
                                                                                          • RegOpenKeyExW.KERNELBASE(?,?,00000000,000F003F,?,?,?,?,00407A92,80000001,?,?,?,Control Panel\Mouse), ref: 004062F9
                                                                                          • RegCreateKeyW.ADVAPI32(?,?,?), ref: 0040630A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateOpen
                                                                                          • String ID:
                                                                                          • API String ID: 436179556-0
                                                                                          • Opcode ID: 0e109d0a580e6c98b93b62d77c4a4da6bfa8e490cdae143853e495c16c1615bb
                                                                                          • Instruction ID: 9126ea088d133241e41a7899570209ae6d0e16c32572248595a4e3a67bbed01d
                                                                                          • Opcode Fuzzy Hash: 0e109d0a580e6c98b93b62d77c4a4da6bfa8e490cdae143853e495c16c1615bb
                                                                                          • Instruction Fuzzy Hash: 67E08C3224021277C6208A66AC48E9BBFACEBCAB61F000825B202E3191C730A800CAB5
                                                                                          APIs
                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000,0040971C,00000001), ref: 0040BAFB
                                                                                            • Part of subcall function 0040D8F3: HeapAlloc.KERNEL32(00000000,00000140,0040BB0F), ref: 0040D900
                                                                                          • HeapDestroy.KERNEL32 ref: 0040BB19
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$AllocCreateDestroy
                                                                                          • String ID:
                                                                                          • API String ID: 2236781399-0
                                                                                          • Opcode ID: 2e50444a34c1365517b8b9c8380c75135649fd826d11eeaaa94557362d52f37e
                                                                                          • Instruction ID: 75a5c90370eac10a2e96e1f5706bba1ec454fd3cc8cc8d2019e76cbdbb01333e
                                                                                          • Opcode Fuzzy Hash: 2e50444a34c1365517b8b9c8380c75135649fd826d11eeaaa94557362d52f37e
                                                                                          • Instruction Fuzzy Hash: BBE012757543006AEB105F709D09BB636E4EB4C782F50847AF544D41E4E7748441D54D
                                                                                          APIs
                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000,021B14E1,00000001), ref: 021B2890
                                                                                            • Part of subcall function 021B3C25: HeapAlloc.KERNEL32(00000000,00000140,021B28A4), ref: 021B3C32
                                                                                          • HeapDestroy.KERNEL32 ref: 021B28AE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$AllocCreateDestroy
                                                                                          • String ID:
                                                                                          • API String ID: 2236781399-0
                                                                                          • Opcode ID: ea3ff4217ae1c06409afbed45fb10fead3ea7bb1635d7ab69f889ca9dcdb0ee4
                                                                                          • Instruction ID: 1d8e25ee1c7802349935f7e7178924674e41b977650f67ad62ef29cf3e54203e
                                                                                          • Opcode Fuzzy Hash: ea3ff4217ae1c06409afbed45fb10fead3ea7bb1635d7ab69f889ca9dcdb0ee4
                                                                                          • Instruction Fuzzy Hash: 13E01271ED43425EEF121B719D097AB36F59F54782F104CB5F945C40D4E77184E19910
                                                                                          APIs
                                                                                          • RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,?), ref: 10002307
                                                                                            • Part of subcall function 10001F46: InitializeCriticalSection.KERNEL32(00000000,?,?,?,10002178,00000009,?,?,?), ref: 10001F83
                                                                                            • Part of subcall function 10001F46: EnterCriticalSection.KERNEL32(?,?,?,10002178,00000009,?,?,?), ref: 10001F9E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$AllocateEnterHeapInitialize
                                                                                          • String ID:
                                                                                          • API String ID: 1616793339-0
                                                                                          • Opcode ID: e67827edf362c4381ee763cfc867e8288de09df3c8b3be29131b96be8511ba8e
                                                                                          • Instruction ID: 6e5a037c05833a134d6403d87e0710c28580c946d01eb6db65b6949418f02b65
                                                                                          • Opcode Fuzzy Hash: e67827edf362c4381ee763cfc867e8288de09df3c8b3be29131b96be8511ba8e
                                                                                          • Instruction Fuzzy Hash: F9218631A00255BBFB10DBE8DD82BDEB7A8FB00BE4F114525F410EB5D8D774AA819B94
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00412314
                                                                                            • Part of subcall function 00419175: TlsGetValue.KERNEL32(004465C0,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26,?,00000000,?,004115DF,00000000,00000000,00000000,00000000), ref: 004191B4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: H_prologValue
                                                                                          • String ID:
                                                                                          • API String ID: 3700342317-0
                                                                                          • Opcode ID: 4de7fa114a8073cfda8c586855b50239cda6caa7ffa24b67eb517c1c6688f97a
                                                                                          • Instruction ID: 22e8248f788d5f27922ed72e731de7211f5e93a83790ca3404ff804e64ab8b03
                                                                                          • Opcode Fuzzy Hash: 4de7fa114a8073cfda8c586855b50239cda6caa7ffa24b67eb517c1c6688f97a
                                                                                          • Instruction Fuzzy Hash: D0214872A00209AFCF05DF54C581AEE7BB9EB05354F00406AF915AB241D7B9AEA4CB95
                                                                                          APIs
                                                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00412A5C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateWindow
                                                                                          • String ID:
                                                                                          • API String ID: 716092398-0
                                                                                          • Opcode ID: 1284ed902f479d50210573dcdfc74b66b5793867c6bafe36e7a17f1f1ddd84b0
                                                                                          • Instruction ID: 0b6b96930a78b41a84b4f4af52a2c477cb6b0fe03a55e4d5791964c3665969e8
                                                                                          • Opcode Fuzzy Hash: 1284ed902f479d50210573dcdfc74b66b5793867c6bafe36e7a17f1f1ddd84b0
                                                                                          • Instruction Fuzzy Hash: 0B319D75A10219AFCF01DFA8C944AEEBBF1BF4C304F11406AF918E7220D7359A619FA4
                                                                                          APIs
                                                                                          • GetPrivateProfileStringW.KERNEL32 ref: 00401118
                                                                                            • Part of subcall function 00414F8D: InterlockedDecrement.KERNEL32(-000000F4), ref: 00414FA1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfileString
                                                                                          • String ID:
                                                                                          • API String ID: 4250705333-0
                                                                                          • Opcode ID: d9f458ba6dd4b2cdefc934381ca5c13c2b34fb1bdbcb08225f38287e7147ec02
                                                                                          • Instruction ID: 9a420848c4073a2db5b5117f759c1f4d45f7def23841a721c1cd646bbb6c13f8
                                                                                          • Opcode Fuzzy Hash: d9f458ba6dd4b2cdefc934381ca5c13c2b34fb1bdbcb08225f38287e7147ec02
                                                                                          • Instruction Fuzzy Hash: 6C1136746082C0AED335DB14C459BDAB7E8AB88758F00890EF0CD83281C7F859C9CBA6
                                                                                          APIs
                                                                                          • WritePrivateProfileStringW.KERNEL32(?,?,?), ref: 004011C0
                                                                                            • Part of subcall function 00414F8D: InterlockedDecrement.KERNEL32(-000000F4), ref: 00414FA1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfileStringWrite
                                                                                          • String ID:
                                                                                          • API String ID: 4011041634-0
                                                                                          • Opcode ID: ace69ba9060cc4dc9b9397b738e5afce9130e1b94c77fff45157a879135129b6
                                                                                          • Instruction ID: f3bdc4d60dd697023e6f03d84786c11b304fc46d794d698ca236da42766d616f
                                                                                          • Opcode Fuzzy Hash: ace69ba9060cc4dc9b9397b738e5afce9130e1b94c77fff45157a879135129b6
                                                                                          • Instruction Fuzzy Hash: F0F03CB51486429FC304DF59D855B9AB7E8EF98B24F008A0EF4A5433D0D738A80ACB66
                                                                                          APIs
                                                                                          • WritePrivateProfileStructW.KERNEL32(?,?,?,?), ref: 00401245
                                                                                            • Part of subcall function 00414F8D: InterlockedDecrement.KERNEL32(-000000F4), ref: 00414FA1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfileStructWrite
                                                                                          • String ID:
                                                                                          • API String ID: 546477811-0
                                                                                          • Opcode ID: b3d3f7ca489207b26dadae74ba46b1531dbc915a0b5cb5bd7cacbfc2dd8a868c
                                                                                          • Instruction ID: a1cb2f11c91b5aae0f4f6d9aa67cfd56865b6f796144d3fd6b611dbf8eb75ad9
                                                                                          • Opcode Fuzzy Hash: b3d3f7ca489207b26dadae74ba46b1531dbc915a0b5cb5bd7cacbfc2dd8a868c
                                                                                          • Instruction Fuzzy Hash: 91F0F9B5248641AFC204CF58D855F9AB7E8FB88B24F008B1DF4A5933D0D778A945CB66
                                                                                          APIs
                                                                                          • GetPrivateProfileStructW.KERNEL32(?,?,?,?), ref: 004012B5
                                                                                            • Part of subcall function 00414F8D: InterlockedDecrement.KERNEL32(-000000F4), ref: 00414FA1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfileStruct
                                                                                          • String ID:
                                                                                          • API String ID: 3648059442-0
                                                                                          • Opcode ID: a094d6bd747580adcf9925b0f243dd2965dbf6cdcb98553c52eb2062cabac418
                                                                                          • Instruction ID: 9da04ff830bc5443279597f774a8be3da4d56ef936d72f636fc91d4473e1f1e2
                                                                                          • Opcode Fuzzy Hash: a094d6bd747580adcf9925b0f243dd2965dbf6cdcb98553c52eb2062cabac418
                                                                                          • Instruction Fuzzy Hash: 8AF0F9B5648741AFC204CF58D855F9AB7E8FB88B24F008B1DF4A9933D0D738A905CB66
                                                                                          APIs
                                                                                          • RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0040A2EE,000000E0,0040A2DB,?,0040D793,00000018,00000000,?,?,0040E468,00000009), ref: 0040A34F
                                                                                            • Part of subcall function 0040D773: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0040E468,00000009,?,?,?,0040BA3B,00000001,00000074,?,0040972E), ref: 0040D7B0
                                                                                            • Part of subcall function 0040D773: EnterCriticalSection.KERNEL32(?,?,?,0040E468,00000009,?,?,?,0040BA3B,00000001,00000074,?,0040972E), ref: 0040D7CB
                                                                                            • Part of subcall function 0040D7D4: LeaveCriticalSection.KERNEL32(?,0040A32E,00000009,?,00000009,00000000,?,0040A2EE,000000E0,0040A2DB,?,0040D793,00000018,00000000,?), ref: 0040D7E1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$AllocateEnterHeapInitializeLeave
                                                                                          • String ID:
                                                                                          • API String ID: 495028619-0
                                                                                          • Opcode ID: f9928dde3429e10667829b97ae9d295a7ff46b5b12aa757f7611d1f2c176f7e7
                                                                                          • Instruction ID: 4bc035e90f6bb180dec88893ad5dbb992215638b96077e8c0aa25bdc19083679
                                                                                          • Opcode Fuzzy Hash: f9928dde3429e10667829b97ae9d295a7ff46b5b12aa757f7611d1f2c176f7e7
                                                                                          • Instruction Fuzzy Hash: 02E09B33E45630AAD62136697C01BDB26115B41760F1A0137FD547B2D1E7B96C1542DE
                                                                                          APIs
                                                                                          • GetPrivateProfileIntW.KERNEL32(?,?,?), ref: 004013D0
                                                                                            • Part of subcall function 00414F8D: InterlockedDecrement.KERNEL32(-000000F4), ref: 00414FA1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfile
                                                                                          • String ID:
                                                                                          • API String ID: 3423501712-0
                                                                                          • Opcode ID: 5e75438c65d2092cbf5e5ea570d785e9cf674318690a07650165b4c93f908acc
                                                                                          • Instruction ID: 573d369d0c3bae467d253f69bed89f926e04a1af1ed2d957a6755b4fa9c773d3
                                                                                          • Opcode Fuzzy Hash: 5e75438c65d2092cbf5e5ea570d785e9cf674318690a07650165b4c93f908acc
                                                                                          • Instruction Fuzzy Hash: E7F030B51486429FC204CF18D855F9BB7E8FF88B24F008A1DF465837D0D7389809CBA2
                                                                                          APIs
                                                                                          • RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,00403102,MouseSpeed), ref: 00408E32
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: QueryValue
                                                                                          • String ID:
                                                                                          • API String ID: 3660427363-0
                                                                                          • Opcode ID: 0fe67fd3aa9416f4dac703347d8518a90cd191a710a8277aee8a17bf1b3ad1bd
                                                                                          • Instruction ID: cd75f4af6526afb951efd94bb20e755cd78099a6db699eae95823b22e7b0b1b9
                                                                                          • Opcode Fuzzy Hash: 0fe67fd3aa9416f4dac703347d8518a90cd191a710a8277aee8a17bf1b3ad1bd
                                                                                          • Instruction Fuzzy Hash: 8FE0C9B21183429FD308CF54D844E6BB7E9EBD8705F208D1DB19686280D77099088BA5
                                                                                          APIs
                                                                                          • RegSetValueExW.KERNELBASE(?,?,00000000,00000001,0040698A,00000000,?,?,?,?,00000000), ref: 00406380
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value
                                                                                          • String ID:
                                                                                          • API String ID: 3702945584-0
                                                                                          • Opcode ID: b6bd3688e1eaf4b3badbc363d842e8e089bb25e9a6a26a27d556f8f408a22b90
                                                                                          • Instruction ID: ba4cea595592a699331545004aeec72fbd7d51969e66f51fd8d7b9dd7bac6fe4
                                                                                          • Opcode Fuzzy Hash: b6bd3688e1eaf4b3badbc363d842e8e089bb25e9a6a26a27d556f8f408a22b90
                                                                                          • Instruction Fuzzy Hash: FFD05E711047206BE210DB08AC05FDF379DAF88210F04081CB15492180C764A90487A6
                                                                                          APIs
                                                                                          • SetWindowsHookExA.USER32(0000000E,_mousehookproc@12,021B0000,00000000), ref: 021B1083
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: HookWindows
                                                                                          • String ID:
                                                                                          • API String ID: 2559412058-0
                                                                                          • Opcode ID: 27a40b878bbecaabb151166f42d5a28e24ac4b7d742536cd80ca64746ba64dfa
                                                                                          • Instruction ID: 3c4f1743a1c8df9788305c31a6c34bf3e8101348082af24adb299285c379d997
                                                                                          • Opcode Fuzzy Hash: 27a40b878bbecaabb151166f42d5a28e24ac4b7d742536cd80ca64746ba64dfa
                                                                                          • Instruction Fuzzy Hash: 40D01771EC0300ABE3268F25DC65B4737F5AF8C600F00C819F105862C4E7B0D8E88B00
                                                                                          APIs
                                                                                          • LoadStringW.USER32(?,?,?,?), ref: 00416653
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: LoadString
                                                                                          • String ID:
                                                                                          • API String ID: 2948472770-0
                                                                                          • Opcode ID: 01574b545710ffaf44c54bcaab05bf3a7fb84152e5f261b43f2e23ff006c498f
                                                                                          • Instruction ID: 58f394d792328be378a55d21c8c2c52a7b39c2d1507ad5205e1759ce3bd3c67f
                                                                                          • Opcode Fuzzy Hash: 01574b545710ffaf44c54bcaab05bf3a7fb84152e5f261b43f2e23ff006c498f
                                                                                          • Instruction Fuzzy Hash: 8CD09EB65183559B8A119F919848D9BB7A4BF55320B054C1EF85053111D724D454C7A5
                                                                                          APIs
                                                                                          • HeapAlloc.KERNEL32(00000008,?,?,?,?,0040BA3B,00000001,00000074,?,0040972E), ref: 0040E487
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeap
                                                                                          • String ID:
                                                                                          • API String ID: 4292702814-0
                                                                                          • Opcode ID: b46ea7dd3a23d5ee4189a771b4babd82ec28e7573c12488050eec32a2293e59a
                                                                                          • Instruction ID: 71661e906a7872e49b2b907223ce08135b6c1d4b70a6e31a69d9a43993459c4d
                                                                                          • Opcode Fuzzy Hash: b46ea7dd3a23d5ee4189a771b4babd82ec28e7573c12488050eec32a2293e59a
                                                                                          • Instruction Fuzzy Hash: 67019C33A006105AE22136776D41B5F7224DBC17B4F194A3BFDA0773D2D67C4C15829E
                                                                                          APIs
                                                                                          • HeapAlloc.KERNEL32(00000008,?,00000000,00000000,?,021B2155,00000001,00000074,?,021B1EE6,?,?,?,021B195E,021B149E,?), ref: 021B32E5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeap
                                                                                          • String ID:
                                                                                          • API String ID: 4292702814-0
                                                                                          • Opcode ID: 12400cf34e3d8139816235223105c09adb8623d0df84573bd3b30589b9a7fe24
                                                                                          • Instruction ID: 66ca9d388a01821f90a9dc21e75b5b535482ff30134897751ed2b3cc36d3a27e
                                                                                          • Opcode Fuzzy Hash: 12400cf34e3d8139816235223105c09adb8623d0df84573bd3b30589b9a7fe24
                                                                                          • Instruction Fuzzy Hash: 78014737EC0A506AEA2361256C81BDB6275AFC57B1F0A05E1FDB0A72D1EB308C7585E1
                                                                                          APIs
                                                                                          • GetMessageExtraInfo.USER32 ref: 0040438D
                                                                                          • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 0040439C
                                                                                          • Sleep.KERNEL32(00000001), ref: 004043A3
                                                                                          • GetMessageExtraInfo.USER32 ref: 004043AE
                                                                                          • mouse_event.USER32(00000008,00000000,00000000,00000000,00000000), ref: 004043BD
                                                                                          • Sleep.KERNEL32(00000001), ref: 004043C4
                                                                                          • GetMessageExtraInfo.USER32 ref: 004043CF
                                                                                          • mouse_event.USER32(00000020,00000000,00000000,00000000,00000000), ref: 004043DE
                                                                                          • Sleep.KERNEL32(00000001), ref: 004043E5
                                                                                          • GetMessageExtraInfo.USER32 ref: 004043F0
                                                                                          • mouse_event.USER32(00000080,00000000,00000000,00000002,00000000), ref: 00404402
                                                                                          • Sleep.KERNEL32(00000001), ref: 00404409
                                                                                          • wsprintfW.USER32 ref: 0040467A
                                                                                          • OutputDebugStringW.KERNEL32(?,?,?,?,?,75C0B390), ref: 0040468B
                                                                                          • GetMessageExtraInfo.USER32 ref: 00404956
                                                                                          • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00404965
                                                                                          • GetMessageExtraInfo.USER32 ref: 00404970
                                                                                          • mouse_event.USER32(00000010,00000000,00000000,00000000,00000000), ref: 0040497F
                                                                                          • Sleep.KERNEL32(00000032,?,000000FF,?,?,?,?,75C0B390), ref: 00404A46
                                                                                          Strings
                                                                                          • g_iCurAction= %d,start=%d,end=%d, xrefs: 00404674
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExtraInfoMessagemouse_event$Sleep$DebugOutputStringwsprintf
                                                                                          • String ID: g_iCurAction= %d,start=%d,end=%d
                                                                                          • API String ID: 1980266353-2858381847
                                                                                          • Opcode ID: 2597852d740cf200b1fe7d097b7fbc9341962d26f1537d532ea8fa79a1281c68
                                                                                          • Instruction ID: 141e526404bfe4c17a0d7951175cee20fdad0b1145de252aee2f35387aceb844
                                                                                          • Opcode Fuzzy Hash: 2597852d740cf200b1fe7d097b7fbc9341962d26f1537d532ea8fa79a1281c68
                                                                                          • Instruction Fuzzy Hash: C37229B06083409FD724DF69C881B6BB7E5BBC8704F50892EF699A7390D774E940CB5A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: PrivateProfileWrite$Stringlstrlen$IncrementInterlockedStructwsprintf
                                                                                          • String ID: +$0$1$Acceleration$AccelerationFlag$BTOption$BtnConfiguration$Color1Type$Color2Type$ColorChangeMode$ColorChangeModeOptions1$ColorChangeModeOptions2$ColorFlag$ColorOptions$ColorOptions1$ColorOptions2$CpiLevel_X%d$CpiLevel_Y%d$CpiStep$DbleClickSpeed$DpiIndicationType$FireOrOnToGoStatusIndicatorSetting$GameFile$HDDKeyboard$LiftLevel$LiftSwitch$LightEffectSwitch1$LightEffectSwitch2$LightEffectType1$LightEffectType2$LightSwitch$LightType$MacroKeyInfo%d$MediaOption$MouseSpeed$OTGSpeed$Orientation$PollingRate$ProFileName$ProfileSwitchIndictor$ScrollWheelFlag$ScrollWheelSpeed$Sensitivity_X$Sensitivity_Y$Setting$TiltSpeed$XYCpiFlag$XYSynchronous$dpiIndicator%d$dpiStepFlag%d
                                                                                          • API String ID: 793570178-3193685507
                                                                                          • Opcode ID: 5b8dca62559d0112c1314504c40c50f4d5aac05adfce4ac1252981846dbfa050
                                                                                          • Instruction ID: 62130de14bf854f566928c5ecdc26453d82ee69c53e2bbd585e922200b225bfe
                                                                                          • Opcode Fuzzy Hash: 5b8dca62559d0112c1314504c40c50f4d5aac05adfce4ac1252981846dbfa050
                                                                                          • Instruction Fuzzy Hash: 2262B27025D380FBC244EB6AD853A9FBFD1ABD9748F80194EF48553292CB79940487AB
                                                                                          APIs
                                                                                          • GetLastActivePopup.USER32(?), ref: 00404F4F
                                                                                          • SetForegroundWindow.USER32(?), ref: 00404F5F
                                                                                          • CreatePopupMenu.USER32 ref: 00404F65
                                                                                          • LoadStringW.USER32(?,000003EA,?,00000104), ref: 00404F88
                                                                                          • AppendMenuW.USER32(00000000,00000000,00001771,?), ref: 00404F9D
                                                                                          • SetMenuDefaultItem.USER32(00000000,00001771,00000000), ref: 00404FA7
                                                                                          • AppendMenuW.USER32(00000000,00000800,00000000,00000000), ref: 00404FB7
                                                                                          • LoadStringW.USER32(?,000003EB,?,00000104), ref: 00404FCE
                                                                                          • AppendMenuW.USER32(00000000,00000000,00001772,?), ref: 00404FDD
                                                                                          • GetCursorPos.USER32(?), ref: 00404FE4
                                                                                          • TrackPopupMenu.USER32(00000000,00000000,?,?,00000000,?,00000000), ref: 00404FFF
                                                                                          • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 0040500F
                                                                                          • DestroyMenu.USER32(00000000), ref: 00405016
                                                                                          • GetLastActivePopup.USER32(?), ref: 00405041
                                                                                          • IsIconic.USER32(?), ref: 00405057
                                                                                          • SetForegroundWindow.USER32(?), ref: 0040506E
                                                                                          • SetActiveWindow.USER32(?), ref: 00405078
                                                                                          • PostMessageW.USER32(?,0000040F,00000000,00000000), ref: 00405091
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Menu$Popup$ActiveAppendWindow$ForegroundLastLoadMessagePostString$CreateCursorDefaultDestroyIconicItemTrack
                                                                                          • String ID:
                                                                                          • API String ID: 566227479-0
                                                                                          • Opcode ID: 6398802d5b69b3eba1059f1c74711ea152a975bd08ab713493d0dbff8a820099
                                                                                          • Instruction ID: 61b8174d4839d13b59858cf3b00d79c558bd96c92f55ce3e9b8d950aeebdfbc4
                                                                                          • Opcode Fuzzy Hash: 6398802d5b69b3eba1059f1c74711ea152a975bd08ab713493d0dbff8a820099
                                                                                          • Instruction Fuzzy Hash: B2417471240709BFE220DB64DC89F9B7768EF94B45F108929B701AB2D0C7B4E8558BDC
                                                                                          APIs
                                                                                            • Part of subcall function 004146AC: GetWindowLongW.USER32(?,000000F0), ref: 004146B8
                                                                                          • GetKeyState.USER32(00000010), ref: 00413F5A
                                                                                          • GetKeyState.USER32(00000011), ref: 00413F63
                                                                                          • GetKeyState.USER32(00000012), ref: 00413F6C
                                                                                          • SendMessageW.USER32(?,00000111,0000E146,00000000), ref: 00413F82
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: State$LongMessageSendWindow
                                                                                          • String ID:
                                                                                          • API String ID: 1063413437-0
                                                                                          • Opcode ID: 9ec2ec424a58604969bc99ee205cec4451bc0b6a6da03485264d7786f5648576
                                                                                          • Instruction ID: db65c05bfda91721db4efedf3e2b73c2d7479b8718f6a6b56cbfbcbbaa559a31
                                                                                          • Opcode Fuzzy Hash: 9ec2ec424a58604969bc99ee205cec4451bc0b6a6da03485264d7786f5648576
                                                                                          • Instruction Fuzzy Hash: 16F02732B8038925EA283E911C02FEA42344F40BD9F10057FB700BA1D1CAD989D312B8
                                                                                          APIs
                                                                                            • Part of subcall function 0040D773: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0040E468,00000009,?,?,?,0040BA3B,00000001,00000074,?,0040972E), ref: 0040D7B0
                                                                                            • Part of subcall function 0040D773: EnterCriticalSection.KERNEL32(?,?,?,0040E468,00000009,?,?,?,0040BA3B,00000001,00000074,?,0040972E), ref: 0040D7CB
                                                                                            • Part of subcall function 0040D7D4: LeaveCriticalSection.KERNEL32(?,0040A32E,00000009,?,00000009,00000000,?,0040A2EE,000000E0,0040A2DB,?,0040D793,00000018,00000000,?), ref: 0040D7E1
                                                                                          • GetTimeZoneInformation.KERNEL32(0000000C,00000000,0000000C,?,0000000B,0000000B,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000,00000001), ref: 0040ED81
                                                                                          • WideCharToMultiByte.KERNEL32(00000220,00446C0C,000000FF,0000003F,00000000,00000000,?,0000000B,0000000B,?,0040ED24,0040AEF0,00000000,?,?,0040AD63), ref: 0040EE17
                                                                                          • WideCharToMultiByte.KERNEL32(00000220,00446C60,000000FF,0000003F,00000000,00000000,?,0000000B,0000000B,?,0040ED24,0040AEF0,00000000,?,?,0040AD63), ref: 0040EE50
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$ByteCharMultiWide$EnterInformationInitializeLeaveTimeZone
                                                                                          • String ID:
                                                                                          • API String ID: 3442286286-0
                                                                                          • Opcode ID: a4941c39814a3af957cbf8ac27608a5baaa25a846abf08d529a9c6acff5ee522
                                                                                          • Instruction ID: fedbf27f189d6d32ea3b7024e985d00b088f228fe4943d9ebb16898fe0ab8753
                                                                                          • Opcode Fuzzy Hash: a4941c39814a3af957cbf8ac27608a5baaa25a846abf08d529a9c6acff5ee522
                                                                                          • Instruction Fuzzy Hash: F7612671608245BED7349F2AED81B6A7FA4EB06314F54093FE480A72E1C7B84992C74E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: c182e344be76b7102a9b655cd291d2e040a76fc374eb280ad234916fc2b9d1fe
                                                                                          • Instruction ID: 83b8f1474c9f551744ddd4924e22f32432e504d0f9b65742a16a746c194446e6
                                                                                          • Opcode Fuzzy Hash: c182e344be76b7102a9b655cd291d2e040a76fc374eb280ad234916fc2b9d1fe
                                                                                          • Instruction Fuzzy Hash: 5FF03C31504109BACF019F72DE08AAE7BAAEF04344F04C03AF855E51A2DB38CA55EB9D
                                                                                          APIs
                                                                                          • GetKeyState.USER32(00000010), ref: 0041588E
                                                                                          • GetKeyState.USER32(00000011), ref: 00415897
                                                                                          • GetKeyState.USER32(00000012), ref: 004158A0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: State
                                                                                          • String ID:
                                                                                          • API String ID: 1649606143-0
                                                                                          • Opcode ID: 3d35438fdb0d75c294582f6932da150d45b195f453f2e193a91ff43698a50182
                                                                                          • Instruction ID: 7005f42c31c2da84dc95559a954c2c24ebe98142118a0c69523939b8ae4d134e
                                                                                          • Opcode Fuzzy Hash: 3d35438fdb0d75c294582f6932da150d45b195f453f2e193a91ff43698a50182
                                                                                          • Instruction Fuzzy Hash: FAE09235910A59DDEA00B640D940FEA7A905FC0B90F048467FA4CEB092C6A888E2976D
                                                                                          APIs
                                                                                          • keybd_event.USER32(000000B2,00000000,00000001,00000000), ref: 00403862
                                                                                          • Sleep.KERNEL32(00000002,?,00402551,?,?,00000002), ref: 00403866
                                                                                          • keybd_event.USER32(000000B2,00000000,00000003,00000000), ref: 00403877
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: a9d214152ce3addda019d0d12417efe45ad75b83a2cd539779988dd5fb38375f
                                                                                          • Instruction ID: 66bd5dc4433db46890c057d4a1f6809d69ea2b669ee8635e7fbe57374395cb05
                                                                                          • Opcode Fuzzy Hash: a9d214152ce3addda019d0d12417efe45ad75b83a2cd539779988dd5fb38375f
                                                                                          • Instruction Fuzzy Hash: 1ED00232BD133876F5302B957C0BFA97A18DB08F51F25405A77047E0D187D425804AEF
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 004132C9
                                                                                          • GetVersion.KERNEL32(00000007,00000007), ref: 0041347C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: H_prologVersion
                                                                                          • String ID:
                                                                                          • API String ID: 1836448879-0
                                                                                          • Opcode ID: 08d5ef85f46405fe5644a908780d2be8fc801f9b7b6af46eba596e1f5af4d7bb
                                                                                          • Instruction ID: e2bf52880a676a2b4dfb56b748cdaf98b0343b95e11d75aedfde924103eac39e
                                                                                          • Opcode Fuzzy Hash: 08d5ef85f46405fe5644a908780d2be8fc801f9b7b6af46eba596e1f5af4d7bb
                                                                                          • Instruction Fuzzy Hash: 68E18DB0600209FBDF14DF55C880AFE77A9AF04715F10841AF82ADB281D77DDA92DB69
                                                                                          APIs
                                                                                          • SetUnhandledExceptionFilter.KERNEL32(Function_0000D874), ref: 0040D8BF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                          • String ID:
                                                                                          • API String ID: 3192549508-0
                                                                                          • Opcode ID: 7903c46ba7bd349388320bab371f030d29a160c823509f4ec4c74db5070ed1fb
                                                                                          • Instruction ID: 4b20b99325cb60810f59090e80129016fc98ceb3ce0485049bd9be0a3011e73f
                                                                                          • Opcode Fuzzy Hash: 7903c46ba7bd349388320bab371f030d29a160c823509f4ec4c74db5070ed1fb
                                                                                          • Instruction Fuzzy Hash: 3DA024FC4413004FC3001F505C1C5003550F3053417014135D050C0170D7304004450D
                                                                                          APIs
                                                                                          • SetUnhandledExceptionFilter.KERNEL32 ref: 0040D8D1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                          • String ID:
                                                                                          • API String ID: 3192549508-0
                                                                                          • Opcode ID: cdc96b825e0990a2910027ffb09c49490cd60321ae53951b0eef7281a7e235a2
                                                                                          • Instruction ID: 3f35940a9ae13e105c92f18f43654cb07885fb04b49a24daf6a392de1d976108
                                                                                          • Opcode Fuzzy Hash: cdc96b825e0990a2910027ffb09c49490cd60321ae53951b0eef7281a7e235a2
                                                                                          • Instruction Fuzzy Hash:
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
                                                                                          • Instruction ID: bc54bbe2c77bcee01c835bae36207a807839c0f4481313e1208b97c128bc590e
                                                                                          • Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
                                                                                          • Instruction Fuzzy Hash: 45B17C3590020ADFDB15CF05C5D0AA9BBA1FF58318F24C5AED85A6B382C735EA52CB94
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: c6b3f989cb82a1dd4f55b11f40615bf98dce6accb62b13d6a7d6a143855d2ef9
                                                                                          • Instruction ID: 820c0b72e5c41278fa8c8fa55a0398105bf7560e2a4bdd0f675638758ce7a588
                                                                                          • Opcode Fuzzy Hash: c6b3f989cb82a1dd4f55b11f40615bf98dce6accb62b13d6a7d6a143855d2ef9
                                                                                          • Instruction Fuzzy Hash: 1B11C6B5A057008FC728CF2AE490556BBE5FF88314305C97EE48ECB715E634E945CBA4
                                                                                          APIs
                                                                                          • GetCursorPos.USER32(?), ref: 0040529F
                                                                                          • WindowFromPoint.USER32(?,?), ref: 004052AF
                                                                                          • GetClassNameW.USER32(00000000,?,00000104), ref: 004052EA
                                                                                          • GetParent.USER32(00000000), ref: 004053CB
                                                                                          • GetParent.USER32(00000000), ref: 004053CE
                                                                                          • GetClassNameW.USER32(00000000,?,00000104), ref: 004053EF
                                                                                          • OutputDebugStringW.KERNEL32(?), ref: 004053F6
                                                                                          • keybd_event.USER32(000000A2,00000000,00000000,00000000), ref: 0040548F
                                                                                          • Sleep.KERNEL32(00000064), ref: 00405499
                                                                                          • mouse_event.USER32(00008800,00000000,00000000,00000088,00000000), ref: 004054A8
                                                                                          • Sleep.KERNEL32(00000064), ref: 004054B0
                                                                                          • keybd_event.USER32(000000A2,00000000,00000002,00000000), ref: 004054BD
                                                                                          • keybd_event.USER32(000000A2,00000000,00000000,00000000), ref: 004054DF
                                                                                          • Sleep.KERNEL32(00000064), ref: 004054E9
                                                                                          • keybd_event.USER32(0000006D,?,?,?), ref: 00405504
                                                                                          • Sleep.KERNEL32(00000064), ref: 00405508
                                                                                          • keybd_event.USER32(0000006D,00000000,00000002,00000000), ref: 00405516
                                                                                          • keybd_event.USER32(000000A2,00000000,00000000,00000000), ref: 0040553C
                                                                                          • Sleep.KERNEL32(00000064), ref: 00405546
                                                                                          • keybd_event.USER32(0000006D,00000000,00000000,00000000), ref: 00405550
                                                                                          • Sleep.KERNEL32(00000064), ref: 00405554
                                                                                          • keybd_event.USER32(0000006D,00000000,00000002,00000000), ref: 0040555E
                                                                                          • mouse_event.USER32(00008800,00000000,00000000,00000088,00000000), ref: 00405570
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep$ClassNameParentmouse_event$CursorDebugFromOutputPointStringWindow
                                                                                          • String ID: AVL_AVView$AfxWnd42s$EXCEL7$EditControl$FrontPageEditorDocumentView$ImageViewWndClass$Internet Explorer_Server$PSViewC$TabWindowClass$VISIOG$_WwG$paneClassDC
                                                                                          • API String ID: 389203509-1653396800
                                                                                          • Opcode ID: 1dc07490f5fa521fc53b62cd2cf29a4557f070a803eb69b0033014bf69f451f8
                                                                                          • Instruction ID: 38bb068b40c90072cd37ac1ab5bb41aa947a44bbf14c23a80cad506bcfcf707d
                                                                                          • Opcode Fuzzy Hash: 1dc07490f5fa521fc53b62cd2cf29a4557f070a803eb69b0033014bf69f451f8
                                                                                          • Instruction Fuzzy Hash: 2871EB72B8431477E710A7629C06F5B7298DB98B05F50453ABB04B72D1E6B8E9048BAE
                                                                                          APIs
                                                                                          • GetCursorPos.USER32(?), ref: 0040559F
                                                                                          • WindowFromPoint.USER32(?,?), ref: 004055AF
                                                                                          • GetClassNameW.USER32(00000000,?,00000104), ref: 004055EA
                                                                                          • GetParent.USER32(00000000), ref: 004056CB
                                                                                          • GetParent.USER32(00000000), ref: 004056CE
                                                                                          • GetClassNameW.USER32(00000000,?,00000104), ref: 004056EF
                                                                                          • OutputDebugStringW.KERNEL32(?), ref: 004056F6
                                                                                          • keybd_event.USER32(000000A2,00000000,00000000,00000000), ref: 0040578F
                                                                                          • Sleep.KERNEL32(00000064), ref: 00405799
                                                                                          • mouse_event.USER32(00008800,00000000,00000000,00000078,00000000), ref: 004057A8
                                                                                          • Sleep.KERNEL32(00000064), ref: 004057B0
                                                                                          • keybd_event.USER32(000000A2,00000000,00000002,00000000), ref: 004057BD
                                                                                          • keybd_event.USER32(000000A2,00000000,00000000,00000000), ref: 004057DF
                                                                                          • Sleep.KERNEL32(00000064), ref: 004057E9
                                                                                          • keybd_event.USER32(0000006B,?,?,?), ref: 00405804
                                                                                          • Sleep.KERNEL32(00000064), ref: 00405808
                                                                                          • keybd_event.USER32(0000006B,00000000,00000002,00000000), ref: 00405816
                                                                                          • keybd_event.USER32(000000A2,00000000,00000000,00000000), ref: 0040583C
                                                                                          • Sleep.KERNEL32(00000064), ref: 00405846
                                                                                          • keybd_event.USER32(0000006B,00000000,00000000,00000000), ref: 00405850
                                                                                          • Sleep.KERNEL32(00000064), ref: 00405854
                                                                                          • keybd_event.USER32(0000006B,00000000,00000002,00000000), ref: 0040585E
                                                                                          • mouse_event.USER32(00008800,00000000,00000000,00000078,00000000), ref: 00405870
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep$ClassNameParentmouse_event$CursorDebugFromOutputPointStringWindow
                                                                                          • String ID: AVL_AVView$AfxWnd42s$EXCEL7$EditControl$FrontPageEditorDocumentView$ImageViewWndClass$Internet Explorer_Server$PSViewC$TabWindowClass$VISIOG$_WwG$paneClassDC
                                                                                          • API String ID: 389203509-1653396800
                                                                                          • Opcode ID: 49928892bd718f95e37a64d137225447bf2cc0256947348b2f4710882dac1749
                                                                                          • Instruction ID: d9b61d7d1905fa3b4b44a52de13166ca1a7b19eb95011703dd2434c298afba18
                                                                                          • Opcode Fuzzy Hash: 49928892bd718f95e37a64d137225447bf2cc0256947348b2f4710882dac1749
                                                                                          • Instruction Fuzzy Hash: FF71FF72B8430477E710A7629C06F5B7298DB94B05F50493AFB04B72C1E7B9E9048BEE
                                                                                          APIs
                                                                                          • wsprintfW.USER32 ref: 00401835
                                                                                          • GetCursorPos.USER32(?), ref: 0040185E
                                                                                          • mouse_event.USER32(00000002,?,?,00000000,00000000), ref: 00401874
                                                                                          • wsprintfW.USER32 ref: 00401884
                                                                                          • OutputDebugStringW.KERNEL32(?), ref: 00401892
                                                                                          • GetCursorPos.USER32(?), ref: 004018AA
                                                                                          • mouse_event.USER32(00000008,?,?,00000000,00000000), ref: 004018C0
                                                                                          • GetCursorPos.USER32(?), ref: 004018D8
                                                                                          • mouse_event.USER32(00000020,?,?,00000000,00000000), ref: 004018EE
                                                                                          • mouse_event.USER32(00000080,00000000,00000000,00000001,00000000), ref: 0040190E
                                                                                          • mouse_event.USER32(00000080,00000000,00000000,00000002,00000000), ref: 0040192E
                                                                                          • keybd_event.USER32(000000A4,00000000,00000001,00000000), ref: 00401981
                                                                                          • keybd_event.USER32(00000009,00000000,00000001,00000000), ref: 0040198B
                                                                                          • Sleep.KERNEL32(00000002), ref: 0040198F
                                                                                          • keybd_event.USER32(00000009,00000000,00000003,00000000), ref: 0040199D
                                                                                          • SetTimer.USER32(?,00000064,000001F4,00000000), ref: 004019AC
                                                                                          • OutputDebugStringW.KERNEL32(Start....), ref: 004019E1
                                                                                          • SetTimer.USER32(?,000000C8,00000028,00000000), ref: 004019FB
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: mouse_event$Cursorkeybd_event$DebugOutputStringTimerwsprintf$Sleep
                                                                                          • String ID: Button:%x, Function: %x$Start....$click down
                                                                                          • API String ID: 2483592227-2961093199
                                                                                          • Opcode ID: e8d2c10a3b43101cc552c078177dc1a7afdffbf4ff67c85660fdaa1c48dd3a1d
                                                                                          • Instruction ID: 1341aa567dadef79e36ca0af0d8f27de01a7807edd12f1a88b4926236a0f4367
                                                                                          • Opcode Fuzzy Hash: e8d2c10a3b43101cc552c078177dc1a7afdffbf4ff67c85660fdaa1c48dd3a1d
                                                                                          • Instruction Fuzzy Hash: 2A51C53638030567E220AB54FC46FBAB758F7D4721F50843BFA04AA2D1C76A641D87BA
                                                                                          APIs
                                                                                            • Part of subcall function 004146AC: GetWindowLongW.USER32(?,000000F0), ref: 004146B8
                                                                                          • GetParent.USER32(?), ref: 0041413F
                                                                                          • SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 00414162
                                                                                          • GetWindowRect.USER32(?,?), ref: 0041417B
                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 0041418E
                                                                                          • CopyRect.USER32(?,?), ref: 004141DB
                                                                                          • CopyRect.USER32(?,?), ref: 004141E5
                                                                                          • GetWindowRect.USER32(00000000,?), ref: 004141EE
                                                                                          • CopyRect.USER32(?,?), ref: 0041420A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Rect$Window$Copy$Long$MessageParentSend
                                                                                          • String ID: ($@
                                                                                          • API String ID: 808654186-1311469180
                                                                                          • Opcode ID: 2c6a83178c965066824502b15e17b1231ad14acba9a4e845648e7f124205b78a
                                                                                          • Instruction ID: 975b0ebc53819fb63cbb4b5ab59e6cb9c6679fcd35d3c1a0bafaf977f8296738
                                                                                          • Opcode Fuzzy Hash: 2c6a83178c965066824502b15e17b1231ad14acba9a4e845648e7f124205b78a
                                                                                          • Instruction Fuzzy Hash: B7519571900219AFDB11DBA8DD49EEEB7B9AF88314F144166F901F3281D734ED858B58
                                                                                          APIs
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403CD9
                                                                                          • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00403CEA
                                                                                          • Sleep.KERNEL32(00000001,?,?,?,004019C6), ref: 00403CF4
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403CF6
                                                                                          • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00403D01
                                                                                          • Sleep.KERNEL32(00000064,?,?,?,004019C6), ref: 00403D05
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403D07
                                                                                          • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00403D12
                                                                                          • Sleep.KERNEL32(00000001,?,?,?,004019C6), ref: 00403D16
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403D18
                                                                                          • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00403D23
                                                                                          • Sleep.KERNEL32(00000064,?,?,?,004019C6), ref: 00403D27
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403D29
                                                                                          • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00403D34
                                                                                          • Sleep.KERNEL32(00000001,?,?,?,004019C6), ref: 00403D38
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403D3A
                                                                                          • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00403D45
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExtraInfoMessagemouse_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1081616411-0
                                                                                          • Opcode ID: 3559ec84e8d8a01de61bbec3a3d6673555ee542625e94eabd3a5302f8ca7acdc
                                                                                          • Instruction ID: b12f95ceb768882d05332112b862f94f0e79b8dc0ae0ab3f66a0039ad006c6c5
                                                                                          • Opcode Fuzzy Hash: 3559ec84e8d8a01de61bbec3a3d6673555ee542625e94eabd3a5302f8ca7acdc
                                                                                          • Instruction Fuzzy Hash: 3001FDB17C036939F13073B65C8BFAE595CCB84F61F215416B709BE0D289E5B85089BE
                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(USER32,?,?,?,00408FA9), ref: 00408E92
                                                                                          • GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00408EAA
                                                                                          • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00408EBB
                                                                                          • GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00408ECC
                                                                                          • GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 00408EDD
                                                                                          • GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 00408EEE
                                                                                          • GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 00408EFF
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$HandleModule
                                                                                          • String ID: EnumDisplayMonitors$GetMonitorInfoW$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
                                                                                          • API String ID: 667068680-2547861404
                                                                                          • Opcode ID: b1c0822bcba5f18e81aaa25aaca21558a9d8419feaeb6054b94c31364c49f8f1
                                                                                          • Instruction ID: 33863a7cb3c6074cea048375a119fd0aeb175f2da799adeacf5378bc5c69c3c0
                                                                                          • Opcode Fuzzy Hash: b1c0822bcba5f18e81aaa25aaca21558a9d8419feaeb6054b94c31364c49f8f1
                                                                                          • Instruction Fuzzy Hash: 21115178A41211DAC751DF79ADC066ABEF5B68F795362043FD008E2290CF7848C58B6E
                                                                                          APIs
                                                                                            • Part of subcall function 00401730: wsprintfW.USER32 ref: 0040174E
                                                                                            • Part of subcall function 00401730: OutputDebugStringW.KERNEL32(?), ref: 0040175E
                                                                                            • Part of subcall function 00401730: UnhookWindowsHookEx.USER32(?), ref: 00401766
                                                                                            • Part of subcall function 00401730: wsprintfW.USER32 ref: 00401786
                                                                                            • Part of subcall function 00401730: OutputDebugStringW.KERNEL32(?), ref: 00401790
                                                                                          • FindWindowW.USER32(00000000,MOSUE DRIVER V628M), ref: 00402F44
                                                                                          • PostMessageW.USER32(00000000,00000010,00000000,00000000), ref: 00402F55
                                                                                          • Sleep.KERNEL32(000003E8), ref: 00402F6A
                                                                                          • PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 00402F7C
                                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00402F8B
                                                                                          • CloseHandle.KERNEL32(?), ref: 00402F9E
                                                                                          • GetProcAddress.KERNEL32(?,WTSUnRegisterSessionNotification), ref: 00402FB6
                                                                                          • FreeLibrary.KERNEL32(?), ref: 00402FCD
                                                                                          • CoUninitialize.OLE32 ref: 00402FE6
                                                                                          • CloseHandle.KERNEL32(?), ref: 00402FF7
                                                                                          • FreeLibrary.KERNEL32(?), ref: 0040300A
                                                                                          Strings
                                                                                          • WTSUnRegisterSessionNotification, xrefs: 00402FB0
                                                                                          • MOSUE DRIVER V628M, xrefs: 00402F3D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseDebugFreeHandleLibraryMessageOutputPostStringwsprintf$AddressFindHookObjectProcSingleSleepThreadUnhookUninitializeWaitWindowWindows
                                                                                          • String ID: MOSUE DRIVER V628M$WTSUnRegisterSessionNotification
                                                                                          • API String ID: 950618251-2090709928
                                                                                          • Opcode ID: 1991b424470ee17b565ab33a0b6675698e2ea7c506798a328e352ad83cf11534
                                                                                          • Instruction ID: a1bba3e60acd46d1231c672b020c5871b7c645c5ab4d07b336d4de3a11cb1a2c
                                                                                          • Opcode Fuzzy Hash: 1991b424470ee17b565ab33a0b6675698e2ea7c506798a328e352ad83cf11534
                                                                                          • Instruction Fuzzy Hash: 1E213D743007059BD620AFB1DD4DB5B77ACEB89B50F108529B505E72E1CBB9E8008BAC
                                                                                          APIs
                                                                                          • CompareStringW.KERNEL32(00000000,00000000,004446E8,00000001,004446E8,00000001,00000000,-00000004,00000001,?,0040ED24,0040AEF0,00000000,?,?,0040AD63), ref: 0041094E
                                                                                          • CompareStringA.KERNEL32(00000000,00000000,0041CFF4,00000001,0041CFF4,00000001,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 0041096B
                                                                                          • CompareStringA.KERNEL32(00000000,00000000,00000000,00000000,0040AD63,?,00000000,-00000004,00000001,?,0040ED24,0040AEF0,00000000,?,?,0040AD63), ref: 004109C9
                                                                                          • GetCPInfo.KERNEL32(?,00000000,00000000,-00000004,00000001,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410A1A
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410A99
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,00000000,?,00000000,?,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410AFA
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,0040AD63,?,00000000,00000000,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410B0D
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,0040AD63,?,?,00000000,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410B59
                                                                                          • CompareStringW.KERNEL32(00000000,00000000,00000000,?,?,00000000,?,00000000,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410B71
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharCompareMultiStringWide$Info
                                                                                          • String ID: FD
                                                                                          • API String ID: 1651298574-866384278
                                                                                          • Opcode ID: 684768ac77eb776d17a5d2e493f9a6cfb15b2628a48eea9f866b9897b4cfebd1
                                                                                          • Instruction ID: bb372619b0ad374358787c147c7ea3677ea2343dacd45d793cf38ece806f6a50
                                                                                          • Opcode Fuzzy Hash: 684768ac77eb776d17a5d2e493f9a6cfb15b2628a48eea9f866b9897b4cfebd1
                                                                                          • Instruction Fuzzy Hash: F4719B72904249AFDF219F90CC95AEF7BB6EF06384F10412BF950A2260C3798CD1CB99
                                                                                          APIs
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403749
                                                                                          • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 0040375A
                                                                                          • Sleep.KERNEL32(00000001,?,?,?,00402501), ref: 00403764
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403766
                                                                                          • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00403771
                                                                                          • Sleep.KERNEL32(00000014,?,?,?,00402501), ref: 00403775
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403777
                                                                                          • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00403782
                                                                                          • Sleep.KERNEL32(00000001,?,?,?,00402501), ref: 00403786
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403788
                                                                                          • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00403793
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExtraInfoMessagemouse_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1081616411-0
                                                                                          • Opcode ID: d3346a1105fd500594a7da171395717c8bda55fa16a882c667509f96a97bac72
                                                                                          • Instruction ID: 45db5ccda8bafbf9c2e398021487aceeafc28d4ebe3ae6628ae8b691f409a787
                                                                                          • Opcode Fuzzy Hash: d3346a1105fd500594a7da171395717c8bda55fa16a882c667509f96a97bac72
                                                                                          • Instruction Fuzzy Hash: 34F059717C032839F13073A65C87FAE5A5CCB84F61F215012B708BE0D18AE478104ABE
                                                                                          APIs
                                                                                          • GetCursorPos.USER32(?), ref: 00401B35
                                                                                          • mouse_event.USER32(00000004,?,?,00000000,00000000), ref: 00401B4B
                                                                                          • wsprintfW.USER32 ref: 00401B5E
                                                                                          • OutputDebugStringW.KERNEL32(?), ref: 00401B6F
                                                                                          • GetCursorPos.USER32(?), ref: 00401B7F
                                                                                          • mouse_event.USER32(00000010,?,?,00000000,00000000), ref: 00401B95
                                                                                          • GetCursorPos.USER32(?), ref: 00401BA5
                                                                                          • mouse_event.USER32(00000040,?,?,00000000,00000000), ref: 00401BBB
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Cursormouse_event$DebugOutputStringwsprintf
                                                                                          • String ID: click up
                                                                                          • API String ID: 622679599-3899537261
                                                                                          • Opcode ID: 95e96eed326c97e5c5d620c4c8f78c00299521934e12ea34e26528a25a3b6110
                                                                                          • Instruction ID: c53accafaaed797b0aae3ee8ca54a8ecf8b96f3709d53dc86d571738454b13e7
                                                                                          • Opcode Fuzzy Hash: 95e96eed326c97e5c5d620c4c8f78c00299521934e12ea34e26528a25a3b6110
                                                                                          • Instruction Fuzzy Hash: 8E31C075208201AFD324CB54DD89FEA77B8EB88700F00896EF645972D1D7B4A615CB99
                                                                                          APIs
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 0040BCAE
                                                                                          • GetStdHandle.KERNEL32(000000F4,0041CE7C,00000000,?,00000000,?), ref: 0040BD84
                                                                                          • WriteFile.KERNEL32(00000000), ref: 0040BD8B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$HandleModuleNameWrite
                                                                                          • String ID: %B$...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                          • API String ID: 3784150691-270816772
                                                                                          • Opcode ID: 83325f9a9f772eb4297da9b89b69b38fed87ab5dc5f036833081bd734024b4e5
                                                                                          • Instruction ID: c012e0d384e8b5864e04e4cd753f231c77d54383a121936b9ab4a6f7f82d83e2
                                                                                          • Opcode Fuzzy Hash: 83325f9a9f772eb4297da9b89b69b38fed87ab5dc5f036833081bd734024b4e5
                                                                                          • Instruction Fuzzy Hash: CF31C372640218AFEB24E664CD86FDA736CEF45304F5004BBF544F21D1DBB8A9888A9D
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,10001E82,?,Microsoft Visual C++ Runtime Library,00012010,?,10005364,?,100053B4,?,?,?,Runtime Error!Program: ), ref: 10003E26
                                                                                          • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 10003E3E
                                                                                          • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 10003E4F
                                                                                          • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 10003E5C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                          • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                                                          • API String ID: 2238633743-4044615076
                                                                                          • Opcode ID: 1721aa58ad5cd8c3a91b6f355b4f1fdd260ba91aa32b94fb65de52889858e503
                                                                                          • Instruction ID: 7190c3012038fa7a1b34d9c959bb5847bb15d85efb6dfbf0008384d7746fb2f9
                                                                                          • Opcode Fuzzy Hash: 1721aa58ad5cd8c3a91b6f355b4f1fdd260ba91aa32b94fb65de52889858e503
                                                                                          • Instruction Fuzzy Hash: 43011E71601261ABFB42DFB9CCC4E9B7BECFB451D2301852AF644C216ADB7189808B71
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,0040BD65,?,Microsoft Visual C++ Runtime Library,00012010,?,0041CE7C,?,0041CECC,?,?,?,Runtime Error!Program: ), ref: 0040F35D
                                                                                          • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040F375
                                                                                          • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0040F386
                                                                                          • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0040F393
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                          • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                                                          • API String ID: 2238633743-4044615076
                                                                                          • Opcode ID: 6dbcb487d1beb6a6490cc856f9159af8398c24f7f98fc87692ebcf795e895cc0
                                                                                          • Instruction ID: b77228332e0c375f5a6efaf2011bf09e7428bcd33a8c986890ed04f844ea16f6
                                                                                          • Opcode Fuzzy Hash: 6dbcb487d1beb6a6490cc856f9159af8398c24f7f98fc87692ebcf795e895cc0
                                                                                          • Instruction Fuzzy Hash: C101D8B5700311ABC7208FB56CC0A5B7AE8EB46760301403BFA40D36A0DB7988488B59
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,021B2A8D,?,Microsoft Visual C++ Runtime Library,00012010,?,021B63C8,?,021B6418,?,?,?,Runtime Error!Program: ), ref: 021B4480
                                                                                          • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 021B4498
                                                                                          • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 021B44A9
                                                                                          • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 021B44B6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                          • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                                                          • API String ID: 2238633743-4044615076
                                                                                          • Opcode ID: 8866243bf5ee43e3b3b01d1aff5bf6f928d62caf339f40a1e621a6b7640b28b9
                                                                                          • Instruction ID: dcbe5032ea036936ffa3d2c5d0289c8c984ae46ff5bf82edcdcd98e98ab4b5ec
                                                                                          • Opcode Fuzzy Hash: 8866243bf5ee43e3b3b01d1aff5bf6f928d62caf339f40a1e621a6b7640b28b9
                                                                                          • Instruction Fuzzy Hash: AC012136BC0341AF9713DFB99C949ABBBFCAF946943108C29F505D6152D7B08C628B60
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,00414633,?,00020000), ref: 00414342
                                                                                          • LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 0041434B
                                                                                          • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0041435F
                                                                                          • #17.COMCTL32 ref: 0041437A
                                                                                          • #17.COMCTL32 ref: 00414396
                                                                                          • FreeLibrary.KERNEL32(00000000), ref: 004143A2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Library$AddressFreeHandleLoadModuleProc
                                                                                          • String ID: COMCTL32.DLL$InitCommonControlsEx
                                                                                          • API String ID: 1437655972-4218389149
                                                                                          • Opcode ID: cb218ee44ac7b05fbb091c7f047750aa02a3fab161d6d3aa320df361da4c35e5
                                                                                          • Instruction ID: 567019db41a88b5c5ecfc0044aac0a7d6f9175794df0c5c78a33f009d2afb987
                                                                                          • Opcode Fuzzy Hash: cb218ee44ac7b05fbb091c7f047750aa02a3fab161d6d3aa320df361da4c35e5
                                                                                          • Instruction Fuzzy Hash: D0F0F9327802125B4B115B649D884DF77E8EFD87A13254475FD14D3250C724CC4587E9
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DebugOutputStringwsprintf$HookUnhookWindows
                                                                                          • String ID: Hhook: %x$UnHhook: Fail $UnHhook: Success
                                                                                          • API String ID: 3393544223-1816446974
                                                                                          • Opcode ID: ca01ed0eae14bbaf50decd34bb68198da1083fdfffc1d2ffaf86b679c7f15986
                                                                                          • Instruction ID: 74a5d8054bbf24bbe2af7fb7a82fe1ab7e8cfcaa615383d0a0ea569edf75b07f
                                                                                          • Opcode Fuzzy Hash: ca01ed0eae14bbaf50decd34bb68198da1083fdfffc1d2ffaf86b679c7f15986
                                                                                          • Instruction Fuzzy Hash: 41F096796002157BC210D768FC41FEB77ACEBD8700F44883AB904D3161E7B8E5158BE5
                                                                                          APIs
                                                                                          • LCMapStringW.KERNEL32(00000000,00000100,10005478,00000001,00000000,00000000,74DEE860,10008D94,?,00000003,00000000,00000001,00000000,?,?,100045DA), ref: 1000422A
                                                                                          • LCMapStringA.KERNEL32(00000000,00000100,10005474,00000001,00000000,00000000,?,?,100045DA,?), ref: 10004246
                                                                                          • LCMapStringA.KERNEL32(?,?,00000000,00000001,00000000,00000003,74DEE860,10008D94,?,00000003,00000000,00000001,00000000,?,?,100045DA), ref: 1000428F
                                                                                          • MultiByteToWideChar.KERNEL32(?,10008D95,00000000,00000001,00000000,00000000,74DEE860,10008D94,?,00000003,00000000,00000001,00000000,?,?,100045DA), ref: 100042C7
                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,?,00000000), ref: 1000431F
                                                                                          • LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 10004335
                                                                                          • LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 10004368
                                                                                          • LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 100043D0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: String$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 352835431-0
                                                                                          • Opcode ID: 5765a0bb9a5d728441a292b96e76c33121bafcf9e95cf86c742082348360a043
                                                                                          • Instruction ID: 40b6ae88cc97a55ac4c3e609f1b1ce31477a558f4f98b557a913fb5e8627c8b5
                                                                                          • Opcode Fuzzy Hash: 5765a0bb9a5d728441a292b96e76c33121bafcf9e95cf86c742082348360a043
                                                                                          • Instruction Fuzzy Hash: FA518BB1900259EBEF22CF94CC85ADF3BB5FB487D0F128119F950A1168CB328E51DBA4
                                                                                          APIs
                                                                                          • LCMapStringW.KERNEL32(00000000,00000100,004446E8,00000001,00000000,00000000,00000100,00000001,00000000), ref: 00411209
                                                                                          • LCMapStringA.KERNEL32(00000000,00000100,0041CFF4,00000001,00000000,00000000), ref: 00411225
                                                                                          • LCMapStringA.KERNEL32(00000000,?,?,?,?,?,00000100,00000001,00000000), ref: 0041126E
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000002,?,?,00000000,00000000,00000100,00000001,00000000), ref: 004112A6
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,?,00000000), ref: 004112FE
                                                                                          • LCMapStringW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 00411314
                                                                                          • LCMapStringW.KERNEL32(00000000,?,?,00000000,?,?), ref: 00411347
                                                                                          • LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000), ref: 004113AF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: String$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 352835431-0
                                                                                          • Opcode ID: 6e8d97e2c50caedc4945e6a4ca88562f54c8427d7d5ae1f0fc6dbba9c5ff6c87
                                                                                          • Instruction ID: 6c23ddd813f3e17396cf8c82170004dbe1a7682530140ce17ef80fa1a9829735
                                                                                          • Opcode Fuzzy Hash: 6e8d97e2c50caedc4945e6a4ca88562f54c8427d7d5ae1f0fc6dbba9c5ff6c87
                                                                                          • Instruction Fuzzy Hash: 3A518B31900209ABDF228F95CC45ADF7BB5FB49B50F14412AFA21A11A0D3398890DBA9
                                                                                          APIs
                                                                                          • LCMapStringW.KERNEL32(00000000,00000100,021B6494,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 021B4A45
                                                                                          • LCMapStringA.KERNEL32(00000000,00000100,021B6490,00000001,00000000,00000000), ref: 021B4A61
                                                                                          • LCMapStringA.KERNEL32(?,00000100,00000020,00000001,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 021B4AAA
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000101,00000020,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 021B4AE2
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 021B4B3A
                                                                                          • LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 021B4B50
                                                                                          • LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 021B4B83
                                                                                          • LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 021B4BEB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: String$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 352835431-0
                                                                                          • Opcode ID: 1b794f8d96a6270a69283fd3542c1314d134794c1c9492c73de3263e056450b8
                                                                                          • Instruction ID: 54ce8be7ee1a736afc399abf07070aabf25cb80ebfc547cfb6c330b85c208a94
                                                                                          • Opcode Fuzzy Hash: 1b794f8d96a6270a69283fd3542c1314d134794c1c9492c73de3263e056450b8
                                                                                          • Instruction Fuzzy Hash: 59519936980248AFDF238F95CD85EEF7FB9EF49704F108519FA15A2161C3318961EB60
                                                                                          APIs
                                                                                          • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,00409753), ref: 0040B670
                                                                                          • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,00409753), ref: 0040B684
                                                                                          • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,00409753), ref: 0040B6A5
                                                                                          • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0040B6DC
                                                                                          • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,00409753), ref: 0040B6FC
                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00000000,?,00000000,?,?,?,00409753), ref: 0040B71A
                                                                                          • FreeEnvironmentStringsA.KERNEL32(00000000,?,00000000,?,?,?,00409753), ref: 0040B74F
                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00409753,?,00000000,?,?,?,00409753), ref: 0040B77F
                                                                                          • FreeEnvironmentStringsA.KERNEL32(00000000,?,00000000,?,?,?,00409753), ref: 0040B7B5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 158306478-0
                                                                                          • Opcode ID: 6a640f59db1514eec1a3685ebf2cd7e4ffb5e2412858a1e53bc0c3acf2cca7f7
                                                                                          • Instruction ID: ba33e22eb91b5c0fd6508c6f315f3b9194254b05ee26bbd7f98e44984d6b5f68
                                                                                          • Opcode Fuzzy Hash: 6a640f59db1514eec1a3685ebf2cd7e4ffb5e2412858a1e53bc0c3acf2cca7f7
                                                                                          • Instruction Fuzzy Hash: 8F4124325043226BDB316B658C44B6B7698EB86714F15453FE811F73D0EB799C0047DE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000012,00000000,00000001,00000000), ref: 00401F75
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401F7F
                                                                                          • keybd_event.USER32(00000020,00000000,00000001,00000000), ref: 00401F89
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401F8D
                                                                                          • keybd_event.USER32(00000058,00000000,00000001,00000000), ref: 00401F97
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401F9B
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401FA5
                                                                                          • keybd_event.USER32(00000020,00000000,00000003,00000000), ref: 00401FAF
                                                                                          • keybd_event.USER32(00000012,00000000,00000003,00000000), ref: 00401FB9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 67a815f2331fc507b98c20c10087654e4432ba3275d18a7da7415ca6d3e0dab8
                                                                                          • Instruction ID: b4a6d83d46e4c5882294fb0c3bc474e3e8a29419175b7b5e84ad8c1f0bce1daf
                                                                                          • Opcode Fuzzy Hash: 67a815f2331fc507b98c20c10087654e4432ba3275d18a7da7415ca6d3e0dab8
                                                                                          • Instruction Fuzzy Hash: F7F0C031BD076C72F57177A69D0BF9A6D09DB84F10F21402AB7043E1C18AE431149EEE
                                                                                          APIs
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 10001DCB
                                                                                          • GetStdHandle.KERNEL32(000000F4,10005364,00000000,?,00000000,?), ref: 10001EA1
                                                                                          • WriteFile.KERNEL32(00000000), ref: 10001EA8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$HandleModuleNameWrite
                                                                                          • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                          • API String ID: 3784150691-4022980321
                                                                                          • Opcode ID: e976e9c4bccbe35aeadbd54fd1009d7e5adfcdd902012ed817614d53d3c0f7ba
                                                                                          • Instruction ID: 54632975bb859591ddf8dd78c80b2a969d72bf16dc26eabaffdf151a834b359c
                                                                                          • Opcode Fuzzy Hash: e976e9c4bccbe35aeadbd54fd1009d7e5adfcdd902012ed817614d53d3c0f7ba
                                                                                          • Instruction Fuzzy Hash: E6316F72A00218AEFF20DB60CD85FDE73BDEB453C1F500566FA45D6049EA74AA948B51
                                                                                          APIs
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 021B29D6
                                                                                          • GetStdHandle.KERNEL32(000000F4,021B63C8,00000000,?,00000000,?), ref: 021B2AAC
                                                                                          • WriteFile.KERNEL32(00000000), ref: 021B2AB3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$HandleModuleNameWrite
                                                                                          • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                          • API String ID: 3784150691-4022980321
                                                                                          • Opcode ID: dc3aa698343a447c0b919ae7e364fee7d332cc121caa43b71d2eb0188f4ced55
                                                                                          • Instruction ID: 987a6f091ff4aa3dbb998532c8c1e011fc666f6152fd6459a89b2debf13d89fb
                                                                                          • Opcode Fuzzy Hash: dc3aa698343a447c0b919ae7e364fee7d332cc121caa43b71d2eb0188f4ced55
                                                                                          • Instruction Fuzzy Hash: 4F31D472AC0218AFEF23AAA1CC85FDA77BDEF85304F5005A6F945D6080E77095558E51
                                                                                          APIs
                                                                                          • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10001084), ref: 10001994
                                                                                          • GetEnvironmentStrings.KERNEL32(?,?,?,?,10001084), ref: 100019A8
                                                                                          • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,10001084), ref: 100019D4
                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,10001084), ref: 10001A0C
                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,10001084), ref: 10001A2E
                                                                                          • FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,10001084), ref: 10001A47
                                                                                          • GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,10001084), ref: 10001A5A
                                                                                          • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 10001A98
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: EnvironmentStrings$ByteCharFreeMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 1823725401-0
                                                                                          • Opcode ID: fea8053e8a90505693e19b20b241dcf9d6d0450cc9c19637ed71db64a1c72010
                                                                                          • Instruction ID: a4c288e023ee1e04ccb4a92baa3a87b2bffeaacae4cbffb6a214d4c27268a789
                                                                                          • Opcode Fuzzy Hash: fea8053e8a90505693e19b20b241dcf9d6d0450cc9c19637ed71db64a1c72010
                                                                                          • Instruction Fuzzy Hash: 4A3108B2A062665FF720FFB88CC49EF77DCEB472D47160429FA85C3108E6218C4586A3
                                                                                          APIs
                                                                                          • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,021B1536), ref: 021B2768
                                                                                          • GetEnvironmentStrings.KERNEL32(?,?,?,?,021B1536), ref: 021B277C
                                                                                          • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,021B1536), ref: 021B27A8
                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,021B1536), ref: 021B27E0
                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,021B1536), ref: 021B2802
                                                                                          • FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,021B1536), ref: 021B281B
                                                                                          • GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,021B1536), ref: 021B282E
                                                                                          • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 021B286C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: EnvironmentStrings$ByteCharFreeMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 1823725401-0
                                                                                          • Opcode ID: 915864acacf65ea99f08c7de1f9c5012eff8221271204fe045ae9ce4c2e12bfc
                                                                                          • Instruction ID: ab5d3079dcdf3da768c3bd16c9961c19311f93e1f961a463e27be376371b9eb1
                                                                                          • Opcode Fuzzy Hash: 915864acacf65ea99f08c7de1f9c5012eff8221271204fe045ae9ce4c2e12bfc
                                                                                          • Instruction Fuzzy Hash: 683105729842655FDB233E759CC49FBB6FCEE492487110939FD62C3110E7318C9886A1
                                                                                          APIs
                                                                                          • GlobalLock.KERNEL32(?), ref: 00415417
                                                                                          • lstrcmpW.KERNEL32(00000000,?), ref: 00415424
                                                                                          • OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 00415436
                                                                                          • DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00415459
                                                                                          • GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00415461
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0041546E
                                                                                          • DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 0041547B
                                                                                          • ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 00415499
                                                                                            • Part of subcall function 0041735D: GlobalFlags.KERNEL32(?), ref: 00417367
                                                                                            • Part of subcall function 0041735D: GlobalUnlock.KERNEL32(?), ref: 0041737E
                                                                                            • Part of subcall function 0041735D: GlobalFree.KERNEL32(?), ref: 00417389
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
                                                                                          • String ID:
                                                                                          • API String ID: 168474834-0
                                                                                          • Opcode ID: e09c15f029d3d6b033eee8020cf282dadabbdac07907682d4355895b4a97f81b
                                                                                          • Instruction ID: cf4a43030f6e60f28d2c5a714b2929af5268ddbef6d6b6ee1bd13c14d47becbb
                                                                                          • Opcode Fuzzy Hash: e09c15f029d3d6b033eee8020cf282dadabbdac07907682d4355895b4a97f81b
                                                                                          • Instruction Fuzzy Hash: 2F118F71100508FEDB219FA6CC4AEEF7BBEEBC9744F04441AFA09C2121D7399990E768
                                                                                          APIs
                                                                                          • MapVirtualKeyW.USER32(000000A4,00000000), ref: 00403C71
                                                                                          • MapVirtualKeyW.USER32(00000046,00000000), ref: 00403C79
                                                                                          • keybd_event.USER32(000000A4,00000000,00000001,00000000), ref: 00403C8D
                                                                                          • Sleep.KERNEL32(00000002,?,?,?,?,00402226), ref: 00403C97
                                                                                          • keybd_event.USER32(00000046,00000000,00000001,00000000), ref: 00403CA0
                                                                                          • Sleep.KERNEL32(0000000A,?,?,?,?,00402226), ref: 00403CA4
                                                                                          • keybd_event.USER32(00000046,00000000,00000003,00000000), ref: 00403CAD
                                                                                          • keybd_event.USER32(000000A4,00000000,00000003,00000000), ref: 00403CB9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$SleepVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 2173469184-0
                                                                                          • Opcode ID: fd0dc1e6a4020d056813206df5825c64a9a377f8a48829498ed14b081d5cdbe7
                                                                                          • Instruction ID: a8a2d12990e5152527ff904e9d5cb1733cda3e12e9e0e260abd7bb960c68fbcf
                                                                                          • Opcode Fuzzy Hash: fd0dc1e6a4020d056813206df5825c64a9a377f8a48829498ed14b081d5cdbe7
                                                                                          • Instruction Fuzzy Hash: 2FF0AC62BD032C36F53027A69C8BF5B6E5CCB86FA5F21006677046F1C099E6690086AF
                                                                                          APIs
                                                                                          • MapVirtualKeyW.USER32(000000A4,00000000), ref: 00403C11
                                                                                          • MapVirtualKeyW.USER32(00000045,00000000), ref: 00403C19
                                                                                          • keybd_event.USER32(000000A4,00000000,00000001,00000000), ref: 00403C2D
                                                                                          • Sleep.KERNEL32(00000002,?,?,?,?,0040221A), ref: 00403C37
                                                                                          • keybd_event.USER32(00000045,00000000,00000001,00000000), ref: 00403C40
                                                                                          • Sleep.KERNEL32(00000002,?,?,?,?,0040221A), ref: 00403C44
                                                                                          • keybd_event.USER32(00000045,00000000,00000003,00000000), ref: 00403C4D
                                                                                          • keybd_event.USER32(000000A4,00000000,00000003,00000000), ref: 00403C59
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$SleepVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 2173469184-0
                                                                                          • Opcode ID: 9c75504343845f9a653217607227800f5c46b1537074f0f078065ada6cc8830b
                                                                                          • Instruction ID: 169e5063f7c4aa3c30393d3f827236f95650c55ffe2e5866b40dfdc3c87e6380
                                                                                          • Opcode Fuzzy Hash: 9c75504343845f9a653217607227800f5c46b1537074f0f078065ada6cc8830b
                                                                                          • Instruction Fuzzy Hash: 73F0AC62BD036C36F53027A65C4BF5A6E5CCB86FA5F21006677146F1C189E6690086AE
                                                                                          APIs
                                                                                          • PostMessageA.USER32(?,0000040A,00000000,?), ref: 021B12B3
                                                                                          • GetWindowThreadProcessId.USER32(?,?), ref: 021B12CF
                                                                                          • GetForegroundWindow.USER32 ref: 021B12D1
                                                                                          • GetWindowThreadProcessId.USER32(00000000,?), ref: 021B12DD
                                                                                          • CallNextHookEx.USER32(?,?,?,?), ref: 021B130D
                                                                                          Strings
                                                                                          • vkCode = %x , scanCode = %x,flags = %x, , xrefs: 021B115A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ProcessThread$CallForegroundHookMessageNextPost
                                                                                          • String ID: vkCode = %x , scanCode = %x,flags = %x,
                                                                                          • API String ID: 2338096327-3502061832
                                                                                          • Opcode ID: abde2ec2a1905fa830dce3ceba1e32b446d21a1572cd521a955a213af82b811f
                                                                                          • Instruction ID: 89f26e8a6a405e82d39f27113e22c5f4334e0237a4e46f587c71526e608501c1
                                                                                          • Opcode Fuzzy Hash: abde2ec2a1905fa830dce3ceba1e32b446d21a1572cd521a955a213af82b811f
                                                                                          • Instruction Fuzzy Hash: DE512870D84242EADF364E58D5A0BFAB3FAAF46390F3249AED599C6140D37594D0CF42
                                                                                          APIs
                                                                                          • MapVirtualKeyW.USER32(?,00000000), ref: 00403DC6
                                                                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 00403E2D
                                                                                          • Sleep.KERNEL32(00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,00402514,?,00000002), ref: 00403E52
                                                                                          • Sleep.KERNEL32(00000001,00000000,00000010,?,?,?,?,?,?,?,?,?,00402514,?,00000002), ref: 00403E81
                                                                                          • Sleep.KERNEL32(00000001), ref: 00403EB1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Sleep$Virtual
                                                                                          • String ID: [
                                                                                          • API String ID: 1876409814-784033777
                                                                                          • Opcode ID: 271017905ed1df260414b5accf9150753ca4cfb9ec3ead234d31882e2b69e5dd
                                                                                          • Instruction ID: 7beb234933e928ba67ddd4558b7d9d63dcab8ae03f30ab69f891d980f4017d6f
                                                                                          • Opcode Fuzzy Hash: 271017905ed1df260414b5accf9150753ca4cfb9ec3ead234d31882e2b69e5dd
                                                                                          • Instruction Fuzzy Hash: 40418171A043059BE720DE09C88576BBBA8AB85749F040A3FE985773D1C378DE458BDA
                                                                                          APIs
                                                                                          • GetCapture.USER32 ref: 00417D39
                                                                                          • SendMessageW.USER32(00000000,00000365,00000000,00000000), ref: 00417D56
                                                                                          • GetFocus.USER32 ref: 00417D68
                                                                                          • SendMessageW.USER32(00000000,00000365,00000000,00000000), ref: 00417D78
                                                                                          • GetLastActivePopup.USER32(?), ref: 00417D9B
                                                                                          • SendMessageW.USER32(00000000,00000365,00000000,00000000), ref: 00417DAB
                                                                                          • SendMessageW.USER32(?,00000111,0000E147,00000000), ref: 00417DCA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend$ActiveCaptureFocusLastPopup
                                                                                          • String ID:
                                                                                          • API String ID: 3219385341-0
                                                                                          • Opcode ID: b23e63c0c08440a350edcdb87c47aa614841f405802f0dad660620a9eadbd5ec
                                                                                          • Instruction ID: 1bc83817566a28ab4dedd1470a599801a1e56a74d8d0d11617ecfe483c881da7
                                                                                          • Opcode Fuzzy Hash: b23e63c0c08440a350edcdb87c47aa614841f405802f0dad660620a9eadbd5ec
                                                                                          • Instruction Fuzzy Hash: 4811C2B220820D6BD6106A71EC85CBF7E7DDF85799712042FF90183201DB2A9C82557A
                                                                                          APIs
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 004196C9
                                                                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 004196EC
                                                                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 0041970B
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0041971B
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00419725
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreate$Open
                                                                                          • String ID: software
                                                                                          • API String ID: 1740278721-2010147023
                                                                                          • Opcode ID: 34705de9ce26660a2f89bdcca300cb982eed80433ae5ff102644ce9591f8f8ac
                                                                                          • Instruction ID: ded2189dc91411d201accac4a2278f1ec4530f77fbe78492c3e52f54768d73e1
                                                                                          • Opcode Fuzzy Hash: 34705de9ce26660a2f89bdcca300cb982eed80433ae5ff102644ce9591f8f8ac
                                                                                          • Instruction Fuzzy Hash: 7611D476900218FBCB11DB96DC84DEFFFBCEF89740F1440AAE514A2121D370AA40DBA4
                                                                                          APIs
                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00409047
                                                                                          • GetSystemMetrics.USER32(00000000), ref: 0040905F
                                                                                          • GetSystemMetrics.USER32(00000001), ref: 00409066
                                                                                          • lstrcpyW.KERNEL32(?,DISPLAY), ref: 0040908A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: System$Metrics$InfoParameterslstrcpy
                                                                                          • String ID: B$DISPLAY
                                                                                          • API String ID: 1409579217-3316187204
                                                                                          • Opcode ID: a5d1f059fec0d42c9812b0129c4ff23b9438eae330a1c9a018365f960d71a302
                                                                                          • Instruction ID: 1741d29b17dc382d7e9dadd392be428c1b5d463f19bb87b9ec8e024d3ece9218
                                                                                          • Opcode Fuzzy Hash: a5d1f059fec0d42c9812b0129c4ff23b9438eae330a1c9a018365f960d71a302
                                                                                          • Instruction Fuzzy Hash: 5411A331500224ABCF119F659C84A9BBBA8EF09751B00803BFE04AE192D7B5D941CBE9
                                                                                          APIs
                                                                                          • GetForegroundWindow.USER32 ref: 00402920
                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 0040292B
                                                                                          • GetClassNameW.USER32(00000000,?,00000064), ref: 00402944
                                                                                          • PostMessageW.USER32(00000000,00000112,0000F020,00000000), ref: 0040298B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ClassForegroundLongMessageNamePost
                                                                                          • String ID: Shell_TrayWnd$SysTabControl32
                                                                                          • API String ID: 1304669038-4145572703
                                                                                          • Opcode ID: 22f6fff7aa2717f40159a8361b3e254eefccb16011484a6a7dc182f52a7b33a1
                                                                                          • Instruction ID: 603d140806aa5cc73a290ed59403073d6c502f43cd09c160d9cb194cc9c61019
                                                                                          • Opcode Fuzzy Hash: 22f6fff7aa2717f40159a8361b3e254eefccb16011484a6a7dc182f52a7b33a1
                                                                                          • Instruction Fuzzy Hash: 61F0C271644318ABE3209F509D0AFEB7364EB58722F44857EFA01A12D1EBBCA50086AD
                                                                                          APIs
                                                                                          • GetForegroundWindow.USER32 ref: 00401FC0
                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 00401FCB
                                                                                          • GetClassNameW.USER32(00000000,?,00000064), ref: 00401FE4
                                                                                          • PostMessageW.USER32(00000000,00000112,0000F020,00000000), ref: 0040202B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ClassForegroundLongMessageNamePost
                                                                                          • String ID: Shell_TrayWnd$SysTabControl32
                                                                                          • API String ID: 1304669038-4145572703
                                                                                          • Opcode ID: 1ebc8ef16eb546d4f00a092aba2c63ec7b29e1338ebcfa86405fa9eccddaef21
                                                                                          • Instruction ID: edea0b5a1672a99a31c3ec9bb544f84a4db2bb6ca424974792fedebd8a409b47
                                                                                          • Opcode Fuzzy Hash: 1ebc8ef16eb546d4f00a092aba2c63ec7b29e1338ebcfa86405fa9eccddaef21
                                                                                          • Instruction Fuzzy Hash: 11F0C831A44310A7D32197D09E0AFAB7398EB54711F40C57EF501A13C1D7BC990486A9
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401C88
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401C92
                                                                                          • keybd_event.USER32(00000058,00000000,00000001,00000000), ref: 00401C9C
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401CA0
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 1226cfa96fef8d29944da4f28d9bce15ba8d350416b97553f0986b9a1bee56b5
                                                                                          • Instruction ID: 438c33d4dea7c8a20844f77fb02f29de97079e07512127cf98cde8329838f2e9
                                                                                          • Opcode Fuzzy Hash: 1226cfa96fef8d29944da4f28d9bce15ba8d350416b97553f0986b9a1bee56b5
                                                                                          • Instruction Fuzzy Hash: C2F0ED31BC0768B6F57177959D0BF9A6A08D788F10F21402AB7043E1C18AE431459EEB
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401CF2
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401CFC
                                                                                          • keybd_event.USER32(00000056,00000000,00000001,00000000), ref: 00401D06
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401D0A
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 68c3d5998b17d6b5f0082031fc837360c7da5fd9dd3c636c9f12afb7579fe219
                                                                                          • Instruction ID: 73b9d2c619e656af22e07907080db851557bbcbb39fd8f6549463af9859e394f
                                                                                          • Opcode Fuzzy Hash: 68c3d5998b17d6b5f0082031fc837360c7da5fd9dd3c636c9f12afb7579fe219
                                                                                          • Instruction Fuzzy Hash: 73F0ED31BC0768B6F531B7959D0BF9A6A08D788F20F61402AB3043E1C18AE531059EEF
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401CBD
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401CC7
                                                                                          • keybd_event.USER32(00000043,00000000,00000001,00000000), ref: 00401CD1
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401CD5
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: c78330e6c0df12e16d49b48b647794234c02fb98f79deb0e953134e7a73f9201
                                                                                          • Instruction ID: 3b4624a2f8b24345c62611fe5d06676bfc8534608a7ca9dfb68bfcd4c28643f4
                                                                                          • Opcode Fuzzy Hash: c78330e6c0df12e16d49b48b647794234c02fb98f79deb0e953134e7a73f9201
                                                                                          • Instruction Fuzzy Hash: 59F01231BC0768B6F53177959D1BFD96A08DB88F10F21402BB3083E1C18AE832018AEF
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401D5C
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401D66
                                                                                          • keybd_event.USER32(00000041,00000000,00000001,00000000), ref: 00401D70
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401D74
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: fb737189b9b6e998cb9c7eb4f4ffd08c26cbdac5486a337c697a563e64d499a1
                                                                                          • Instruction ID: af19f2fe3c8c34d7c48927506e05f13f819e224579e54560c2a7f2a49958b9e1
                                                                                          • Opcode Fuzzy Hash: fb737189b9b6e998cb9c7eb4f4ffd08c26cbdac5486a337c697a563e64d499a1
                                                                                          • Instruction Fuzzy Hash: 86F01231BD4768B6F53177959D0BFD96A08D788F10F21402BB3083E1C18AE831418AEF
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401D27
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401D31
                                                                                          • keybd_event.USER32(0000005A,00000000,00000001,00000000), ref: 00401D3B
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401D3F
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 1ed9c734f13fd80e67718c7dd33c3f572ed455a4b9f39acbedbb1ed7b54dba45
                                                                                          • Instruction ID: a69ddebc3e768adee39ee6c37a8d5cf4308fa99f4b253fd5576a3e25543a33e3
                                                                                          • Opcode Fuzzy Hash: 1ed9c734f13fd80e67718c7dd33c3f572ed455a4b9f39acbedbb1ed7b54dba45
                                                                                          • Instruction Fuzzy Hash: 21F0ED31BC0768B6F53177959D0BF9A6A08D788F10F21402AB3043E1C18AE431059EEF
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401DFB
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401E05
                                                                                          • keybd_event.USER32(00000050,00000000,00000001,00000000), ref: 00401E0F
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401E13
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: c6e5e196940fb3df467ef07b31799307d7cc8912343fcc096eb15dc2588fcb80
                                                                                          • Instruction ID: fae2f37edfa55018c369bef684fda5294c591b157421ca81cc397a51bfa8a607
                                                                                          • Opcode Fuzzy Hash: c6e5e196940fb3df467ef07b31799307d7cc8912343fcc096eb15dc2588fcb80
                                                                                          • Instruction Fuzzy Hash: 89F0ED31BC0768B6F57177959D0BF9E6A08E788F10F21402AB3043E1C18AE431059EEB
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401D91
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401D9B
                                                                                          • keybd_event.USER32(00000046,00000000,00000001,00000000), ref: 00401DA5
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401DA9
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 744dd662044b1c81411a969280a99ea7f0f06a57b20cb8274f765a1b4e856232
                                                                                          • Instruction ID: a22de9f8485a79bf2eb98d30589dda90b492a0c01fe41e3ba191287440131339
                                                                                          • Opcode Fuzzy Hash: 744dd662044b1c81411a969280a99ea7f0f06a57b20cb8274f765a1b4e856232
                                                                                          • Instruction Fuzzy Hash: 50F0E531BC076876F53177959D4BF9A6904D788F10F21402A73043E1C186E531058ADF
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401DC6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401DD0
                                                                                          • keybd_event.USER32(0000004E,00000000,00000001,00000000), ref: 00401DDA
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401DDE
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 2ad3590229cf11fefefbef75512ffb62b8322e05092ec4153129f9f77bd81128
                                                                                          • Instruction ID: 45ef39b96378be8859d25deb5cf33460d6ef351973741f137d831e8dc3dd58e6
                                                                                          • Opcode Fuzzy Hash: 2ad3590229cf11fefefbef75512ffb62b8322e05092ec4153129f9f77bd81128
                                                                                          • Instruction Fuzzy Hash: 63F0E531BC076876F53177959D0BF996904E788F10F21402A73043E1C186E831418ADF
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401E62
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401E6C
                                                                                          • keybd_event.USER32(0000004F,00000000,00000001,00000000), ref: 00401E76
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401E7A
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: b5ec0d8762c40de35c87594ee7033344472aad97dc52149b1d8c77ddc537cf4b
                                                                                          • Instruction ID: 805ec93a515d081a69fd29b84f4f83282c72531c09ba6940313775bcdcd63248
                                                                                          • Opcode Fuzzy Hash: b5ec0d8762c40de35c87594ee7033344472aad97dc52149b1d8c77ddc537cf4b
                                                                                          • Instruction Fuzzy Hash: C1F0ED31BC0768B6F57177959D0BFA96A08D788F10F21403AB3083E1C18AE831018AEF
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401E30
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401E3A
                                                                                          • keybd_event.USER32(00000053,00000000,00000001,00000000), ref: 00401E44
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401E48
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 0cb1f46c99ec2d8edf390d19d2ee848e09365f70c7a72ac70f637132df88592d
                                                                                          • Instruction ID: c485e8da16458400caf46752d6b32465e14888ad19fa52b0cd46c813b350b81e
                                                                                          • Opcode Fuzzy Hash: 0cb1f46c99ec2d8edf390d19d2ee848e09365f70c7a72ac70f637132df88592d
                                                                                          • Instruction Fuzzy Hash: D0F0ED32BC0768B6F53177959D1BF9A6A08D788F10F21402AB3043E1C18AE432059EEB
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00401E94
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401E9E
                                                                                          • keybd_event.USER32(00000059,00000000,00000001,00000000), ref: 00401EA8
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EAC
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 00401EB6
                                                                                          • Sleep.KERNEL32(00000002), ref: 00401EBA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00401EC4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 73058f3b1e0701a0a5c8d887113ae0b60ff83c36d78d34ccf3588f7dd0735da1
                                                                                          • Instruction ID: a6a3a9b7a0c1e35465c87dcb6dac3aefed862a7b36a95ec0c0d4cb6c428fb3dc
                                                                                          • Opcode Fuzzy Hash: 73058f3b1e0701a0a5c8d887113ae0b60ff83c36d78d34ccf3588f7dd0735da1
                                                                                          • Instruction Fuzzy Hash: F3F01231BC076CB6F53177959D0BFDA6A08D788F10F25402AB3043E1C18AE431009EEA
                                                                                          APIs
                                                                                          • GetSysColor.USER32(0000000F), ref: 004163AC
                                                                                          • GetSysColor.USER32(00000010), ref: 004163B3
                                                                                          • GetSysColor.USER32(00000014), ref: 004163BA
                                                                                          • GetSysColor.USER32(00000012), ref: 004163C1
                                                                                          • GetSysColor.USER32(00000006), ref: 004163C8
                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 004163D5
                                                                                          • GetSysColorBrush.USER32(00000006), ref: 004163DC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Color$Brush
                                                                                          • String ID:
                                                                                          • API String ID: 2798902688-0
                                                                                          • Opcode ID: 9e854bc2c3344c85ffea9bc1bf78de820e244c7b96005e1304b798dd766fa0b7
                                                                                          • Instruction ID: 6708cd917bae5f0bfb1c5316930c5bbee655d2713a6a58bdd3dab7890e993d2e
                                                                                          • Opcode Fuzzy Hash: 9e854bc2c3344c85ffea9bc1bf78de820e244c7b96005e1304b798dd766fa0b7
                                                                                          • Instruction Fuzzy Hash: D2F01C719407489BD730BF729D09B47BAE4FFC4B10F02092ED2858BA90E7B5A400DF54
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Version$MessageRegisterWindow
                                                                                          • String ID: MSWHEEL_ROLLMSG
                                                                                          • API String ID: 303823969-2485103130
                                                                                          • Opcode ID: b6b7b09a7b8593a200c6b0d0df8b8b67ee20159c8a0a4f28db9d96bd27f82f84
                                                                                          • Instruction ID: eeec7272220b17f02deefdb4578fb240ec776a8ca17ab51b5883f2b365bc7da5
                                                                                          • Opcode Fuzzy Hash: b6b7b09a7b8593a200c6b0d0df8b8b67ee20159c8a0a4f28db9d96bd27f82f84
                                                                                          • Instruction Fuzzy Hash: 27E04F3A84012A9ADB113768AC043E62ED49B4E3A4F53403FDD0082250DF7C48CB8ABE
                                                                                          APIs
                                                                                          • GetStringTypeW.KERNEL32(00000001,004446E8,00000001,?), ref: 0040FF72
                                                                                          • GetStringTypeA.KERNEL32(00000000,00000001,0041CFF4,00000001,?), ref: 0040FF8C
                                                                                          • GetStringTypeW.KERNEL32(?,?,?,?), ref: 0040FFB3
                                                                                          • WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 0040FFE6
                                                                                          • WideCharToMultiByte.KERNEL32(?,00000220,?,?,00000000,00000000,00000000,00000000), ref: 0041004F
                                                                                          • GetStringTypeA.KERNEL32(?,?,?,?), ref: 004100BA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: StringType$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 3852931651-0
                                                                                          • Opcode ID: df6ffbaffd882d3968b13579a48c9cb1f41b2a12cb9c38d3f36172c20621bb9c
                                                                                          • Instruction ID: cf97c55ac1e7d71ebdbecd2b381ebf530571ab2b740fc07d8de6cb2ce72fd7ee
                                                                                          • Opcode Fuzzy Hash: df6ffbaffd882d3968b13579a48c9cb1f41b2a12cb9c38d3f36172c20621bb9c
                                                                                          • Instruction Fuzzy Hash: 34519031A00209EBCF218F54DC49EDFBFB4FB4A754F11852BF510A2290D7799991CB99
                                                                                          APIs
                                                                                          • GetStringTypeW.KERNEL32(00000001,10005478,00000001,?,74DEE860,10008D94,?,?,00000002,00000000,?,?,100045DA,?), ref: 10004476
                                                                                          • GetStringTypeA.KERNEL32(00000000,00000001,10005474,00000001,?,?,?,100045DA,?), ref: 10004490
                                                                                          • GetStringTypeA.KERNEL32(?,?,?,00000000,00000002,74DEE860,10008D94,?,?,00000002,00000000,?,?,100045DA,?), ref: 100044C4
                                                                                          • MultiByteToWideChar.KERNEL32(?,10008D95,?,00000000,00000000,00000000,74DEE860,10008D94,?,?,00000002,00000000,?,?,100045DA,?), ref: 100044FC
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 10004552
                                                                                          • GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 10004564
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: StringType$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 3852931651-0
                                                                                          • Opcode ID: 07a15db134c67910903741705dde6b26353cf1debabf8f03109f26d13ec7714e
                                                                                          • Instruction ID: 5c35073270179039f06aeafaf68d6b9059b9128a6b1e1d8b664f82b28f06afa9
                                                                                          • Opcode Fuzzy Hash: 07a15db134c67910903741705dde6b26353cf1debabf8f03109f26d13ec7714e
                                                                                          • Instruction Fuzzy Hash: B3418BB250122AAFEB11DF94CC85EEF3FB9FB083D5F124529FA0192164CB318950CBA5
                                                                                          APIs
                                                                                          • GetStringTypeW.KERNEL32(00000001,004446E8,00000001,-00000033,00000000,-00000003,-00000033,0000000C,-00000003,?,00000000,0040EEF9,-00000003), ref: 00410457
                                                                                          • GetStringTypeA.KERNEL32(00000000,00000001,0041CFF4,00000001,?,?,00000000,0040EEF9,-00000003), ref: 00410471
                                                                                          • GetStringTypeA.KERNEL32(-00000033,0040EEF9,00000000,?,-00000003,00000000,-00000003,-00000033,0000000C,-00000003,?,00000000,0040EEF9,-00000003), ref: 004104A5
                                                                                          • MultiByteToWideChar.KERNEL32(0000000C,-00000002,00000000,?,00000000,00000000,00000000,-00000003,-00000033,0000000C,-00000003,?,00000000,0040EEF9,-00000003), ref: 004104DD
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000,0040EEF9), ref: 00410533
                                                                                          • GetStringTypeW.KERNEL32(0040EEF9,?,00000000,?,?,?,?,?,?,?,?,?,00000000,0040EEF9), ref: 00410545
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: StringType$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 3852931651-0
                                                                                          • Opcode ID: fbd0b8ee9fd5901ad82e67d3f4945e1066add9ccc50c872e688473016da85357
                                                                                          • Instruction ID: 8432798e539918a7a105bb3462c00e31400aa65e2274adde8d24f566b79328ca
                                                                                          • Opcode Fuzzy Hash: fbd0b8ee9fd5901ad82e67d3f4945e1066add9ccc50c872e688473016da85357
                                                                                          • Instruction Fuzzy Hash: 4A417E72A00219FFCF219F94CC89EEF7F79EB09750F104526FA15D6250D37989908BA9
                                                                                          APIs
                                                                                          • GetStringTypeW.KERNEL32(00000001,021B6494,00000001,00000000,?,00000100,00000000,021B37E2,00000001,00000020,00000100,?,00000000), ref: 021B4C91
                                                                                          • GetStringTypeA.KERNEL32(00000000,00000001,021B6490,00000001,?), ref: 021B4CAB
                                                                                          • GetStringTypeA.KERNEL32(00000000,?,00000100,00000020,00000001,?,00000100,00000000,021B37E2,00000001,00000020,00000100,?,00000000), ref: 021B4CDF
                                                                                          • MultiByteToWideChar.KERNEL32(021B37E2,00000101,00000100,00000020,00000000,00000000,?,00000100,00000000,021B37E2,00000001,00000020,00000100,?,00000000), ref: 021B4D17
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 021B4D6D
                                                                                          • GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 021B4D7F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: StringType$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 3852931651-0
                                                                                          • Opcode ID: b888169b3dc323e5bb7ab18862672bede29e11ce662e1fc2e0849bc68f4a8a45
                                                                                          • Instruction ID: b1080346a11b11085950bf17e90990161a8f6f4aba8344fdca48a9b2175b959c
                                                                                          • Opcode Fuzzy Hash: b888169b3dc323e5bb7ab18862672bede29e11ce662e1fc2e0849bc68f4a8a45
                                                                                          • Instruction Fuzzy Hash: F9418D72980249AFDF129F94DC95AEF7BB9FF18714F108929F915D2191C3329860CBA0
                                                                                          APIs
                                                                                          • TlsGetValue.KERNEL32(004465C0,004460F8,00000000,?,004465C0,?,004191E5,004460F8,00000000,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26), ref: 00418F88
                                                                                          • EnterCriticalSection.KERNEL32(004465DC,00000010,?,004465C0,?,004191E5,004460F8,00000000,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26), ref: 00418FD7
                                                                                          • LeaveCriticalSection.KERNEL32(004465DC,00000000,?,004465C0,?,004191E5,004460F8,00000000,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26), ref: 00418FEA
                                                                                          • LocalAlloc.KERNEL32(00000000,00000004,?,004465C0,?,004191E5,004460F8,00000000,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26), ref: 00419000
                                                                                          • LocalReAlloc.KERNEL32(?,00000004,00000002,?,004465C0,?,004191E5,004460F8,00000000,?,00000000,004189E0,00418139,004189FC,004154AA,00416C26), ref: 00419012
                                                                                          • TlsSetValue.KERNEL32(004465C0,00000000), ref: 0041904E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocCriticalLocalSectionValue$EnterLeave
                                                                                          • String ID:
                                                                                          • API String ID: 4117633390-0
                                                                                          • Opcode ID: 97e0f78f5eb08e60051412ac366e5df3ad77423870fd46d7e2b5fa2228e60597
                                                                                          • Instruction ID: 19f1799ff649129f37fb084c00e1d7b94056faeb627ae6e58567b573dc21369e
                                                                                          • Opcode Fuzzy Hash: 97e0f78f5eb08e60051412ac366e5df3ad77423870fd46d7e2b5fa2228e60597
                                                                                          • Instruction Fuzzy Hash: F2318D71200605AFD724CF25C899FA7BBE8FF48354F00C52EE52A87650DB34E949CBA5
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 0041315D
                                                                                          • SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 004131AA
                                                                                          • SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 004131CC
                                                                                          • GetCapture.USER32 ref: 004131DE
                                                                                          • SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 004131ED
                                                                                          • WinHelpW.USER32(?,?,?,?), ref: 00413201
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend$CaptureH_prologHelp
                                                                                          • String ID:
                                                                                          • API String ID: 432264411-0
                                                                                          • Opcode ID: fb8e160b677a99359ae12664e29f13ca847dcfe09f23ade7a7b9b2c30ca8ee7e
                                                                                          • Instruction ID: e3e6272e82f4caab9f5d1593ec914dc0ba72b4baa3cf7b69697257e3e39aa6a4
                                                                                          • Opcode Fuzzy Hash: fb8e160b677a99359ae12664e29f13ca847dcfe09f23ade7a7b9b2c30ca8ee7e
                                                                                          • Instruction Fuzzy Hash: DF21A171240208BFEB206F65CC89FBABBA9EF44744F14857EB2419B1E2CB758D408B58
                                                                                          APIs
                                                                                          • GetParent.USER32(?), ref: 00417CBB
                                                                                          • GetLastActivePopup.USER32(?), ref: 00417CCA
                                                                                          • IsWindowEnabled.USER32(?), ref: 00417CDF
                                                                                          • EnableWindow.USER32(?,00000000), ref: 00417CF2
                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00417D04
                                                                                          • GetParent.USER32(?), ref: 00417D12
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
                                                                                          • String ID:
                                                                                          • API String ID: 670545878-0
                                                                                          • Opcode ID: 77e004a161581c6579e44ee95bfb5597e206af0916be98f3aeb267ba1050f046
                                                                                          • Instruction ID: 2d5acd75821f101e7b8166bf5dd7ef93f3465745368648a92635754c9156fe7b
                                                                                          • Opcode Fuzzy Hash: 77e004a161581c6579e44ee95bfb5597e206af0916be98f3aeb267ba1050f046
                                                                                          • Instruction Fuzzy Hash: 8411023260932947D7315A6AAC84BFBB3F89F54BA1F154166EC01E3301EB28CC8142FD
                                                                                          APIs
                                                                                          • GetCommandLineW.KERNEL32(?,00000000,?,?,00409749), ref: 0040B7D8
                                                                                          • GetCommandLineA.KERNEL32(?,00000000,?,?,00409749), ref: 0040B7EA
                                                                                          • GetCommandLineW.KERNEL32(?,00000000,?,?,00409749), ref: 0040B801
                                                                                          • GetCommandLineA.KERNEL32(?,00000000,?,?,00409749), ref: 0040B80A
                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00000000,?,00000000,?,?,00409749), ref: 0040B823
                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00000000,?,00000000,?,?,00409749), ref: 0040B848
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CommandLine$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 3068183746-0
                                                                                          • Opcode ID: 77f8fc98af0c841e242e8f0832cd457d8e58b5ca00d2d59980e248357e8524ce
                                                                                          • Instruction ID: 4a9b0104cc074979c531274bc16edf2c92997d29f38c7cc677b0183a3382b30e
                                                                                          • Opcode Fuzzy Hash: 77f8fc98af0c841e242e8f0832cd457d8e58b5ca00d2d59980e248357e8524ce
                                                                                          • Instruction Fuzzy Hash: 6F11A937104619A6D7107B655C50B67374DDB523A4F16813BE510F32F0D775DC015AED
                                                                                          APIs
                                                                                          • VirtualFree.KERNEL32(0000000C,00100000,00004000,?,?,?,?,100010D5,10001129,?,?,?), ref: 10001CB5
                                                                                          • VirtualFree.KERNEL32(0000000C,00000000,00008000,?,?,?,?,100010D5,10001129,?,?,?), ref: 10001CC0
                                                                                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,100010D5,10001129,?,?,?), ref: 10001CCD
                                                                                          • HeapFree.KERNEL32(00000000,?,?,?,?,100010D5,10001129,?,?,?), ref: 10001CE9
                                                                                          • VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,100010D5,10001129,?,?,?), ref: 10001D0A
                                                                                          • HeapDestroy.KERNEL32(?,?,100010D5,10001129,?,?,?), ref: 10001D1C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Free$HeapVirtual$Destroy
                                                                                          • String ID:
                                                                                          • API String ID: 716807051-0
                                                                                          • Opcode ID: 6720dd60c10f63fa7f3e8b99f5cdca021b0909409beda15dd28c39c3d664ecd0
                                                                                          • Instruction ID: 5661ad87483502374a34a370f03ae8ed0e2eccc90e3433fca1d9445df7713565
                                                                                          • Opcode Fuzzy Hash: 6720dd60c10f63fa7f3e8b99f5cdca021b0909409beda15dd28c39c3d664ecd0
                                                                                          • Instruction Fuzzy Hash: 65117931640226BFF6619B20DCC5F5AB3A6FB447E1F324226FA80670B8C672BD418B54
                                                                                          APIs
                                                                                          • ClientToScreen.USER32(?,?), ref: 00417286
                                                                                          • GetWindow.USER32(?,00000005), ref: 00417297
                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004172A0
                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 004172AF
                                                                                          • GetWindowRect.USER32(00000000,?), ref: 004172C1
                                                                                          • PtInRect.USER32(?,?,?), ref: 004172D1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Rect$ClientCtrlLongScreen
                                                                                          • String ID:
                                                                                          • API String ID: 1315500227-0
                                                                                          • Opcode ID: c53d5288ba012714e815d1d38efb316e0cfbe43e548fa709a6b5e66125ebf65f
                                                                                          • Instruction ID: d37663858a608f8b182c66e48cd597268a0e2121b7d4f75429c6d9cf1b0fd886
                                                                                          • Opcode Fuzzy Hash: c53d5288ba012714e815d1d38efb316e0cfbe43e548fa709a6b5e66125ebf65f
                                                                                          • Instruction Fuzzy Hash: 44012832208129ABDB119B64EC08EEF7B68EF49710F44C072F911962A1E73899569ADC
                                                                                          APIs
                                                                                          • keybd_event.USER32(000000A4,00000000,00000001,00000000), ref: 00402069
                                                                                          • Sleep.KERNEL32(0000000A), ref: 00402073
                                                                                          • keybd_event.USER32(00000073,00000000,00000001,00000000), ref: 0040207D
                                                                                          • Sleep.KERNEL32(0000000A), ref: 00402081
                                                                                          • keybd_event.USER32(00000073,00000000,00000003,00000000), ref: 0040208B
                                                                                          • keybd_event.USER32(000000A4,00000000,00000003,00000000), ref: 00402098
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 61da7adeeca61e2a8829824218a772a7f61d5e2cb5d671d8867b46980e209a5b
                                                                                          • Instruction ID: c256c57b67d68c93d31bf2d881319c4b34c13cd78089e60f18a618d03bb2e96b
                                                                                          • Opcode Fuzzy Hash: 61da7adeeca61e2a8829824218a772a7f61d5e2cb5d671d8867b46980e209a5b
                                                                                          • Instruction Fuzzy Hash: 84F01235BC435576F13167A59D17F896A04DB88F10F20402A73443E1C086E432018ADF
                                                                                          APIs
                                                                                          • keybd_event.USER32(0000005B,00000000,00000001,00000000), ref: 0040218B
                                                                                          • Sleep.KERNEL32(00000014), ref: 00402195
                                                                                          • keybd_event.USER32(00000044,00000000,00000001,00000000), ref: 0040219F
                                                                                          • Sleep.KERNEL32(00000032), ref: 004021A3
                                                                                          • keybd_event.USER32(00000044,00000000,00000003,00000000), ref: 004021AD
                                                                                          • keybd_event.USER32(0000005B,00000000,00000003,00000000), ref: 004021B7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 3a0a89669a54c6dae4e6367251c2f09379142ffcf04ea30c5acd4c86c12050e1
                                                                                          • Instruction ID: 11065d218eb8beb90204cb6aa65e4643215959b38a0571cc104cc29fff5dde58
                                                                                          • Opcode Fuzzy Hash: 3a0a89669a54c6dae4e6367251c2f09379142ffcf04ea30c5acd4c86c12050e1
                                                                                          • Instruction Fuzzy Hash: CAF01A32BC075876F53267A59D07F9A6A08E788F10F21402AB3043E1C08AF832008EEE
                                                                                          APIs
                                                                                          • keybd_event.USER32(0000005B,00000000,00000001,00000000), ref: 0040214A
                                                                                          • Sleep.KERNEL32(00000014), ref: 00402154
                                                                                          • keybd_event.USER32(00000052,00000000,00000001,00000000), ref: 0040215E
                                                                                          • Sleep.KERNEL32(00000032), ref: 00402162
                                                                                          • keybd_event.USER32(00000052,00000000,00000003,00000000), ref: 0040216C
                                                                                          • keybd_event.USER32(0000005B,00000000,00000003,00000000), ref: 00402176
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 54f71dc0820355be4e91742cc4b7e441b155ad57ac4d1f0c20e8bebb05e20b00
                                                                                          • Instruction ID: 52f35a9ca8a5a5a135cf3cc668eb40a47da625190b762b9a560679391290c2e8
                                                                                          • Opcode Fuzzy Hash: 54f71dc0820355be4e91742cc4b7e441b155ad57ac4d1f0c20e8bebb05e20b00
                                                                                          • Instruction Fuzzy Hash: 79F01231BC075C76F53167A59D07F9A6A08DB88F11F21402A73003E1C086E431009EEA
                                                                                          APIs
                                                                                          • keybd_event.USER32(000000A4,00000000,00000001,00000000), ref: 004029EE
                                                                                          • Sleep.KERNEL32(00000002), ref: 004029F8
                                                                                          • keybd_event.USER32(00000073,00000000,00000001,00000000), ref: 00402A02
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402A06
                                                                                          • keybd_event.USER32(00000073,00000000,00000003,00000000), ref: 00402A10
                                                                                          • keybd_event.USER32(000000A4,00000000,00000003,00000000), ref: 00402A1D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: fcfbfae5eac34d0bccbe1ad9bff2105aea821250a9e5228b41f3881d28bc6b14
                                                                                          • Instruction ID: f6776130bf7d065592641bfc66a81a83fbb850b4138131a29514da803c6697e9
                                                                                          • Opcode Fuzzy Hash: fcfbfae5eac34d0bccbe1ad9bff2105aea821250a9e5228b41f3881d28bc6b14
                                                                                          • Instruction Fuzzy Hash: 30F01235BC035976F1306B559C17FD96A14DB88F20F20402A73443E1C08AE831018ADF
                                                                                          APIs
                                                                                          • keybd_event.USER32(000000A4,00000000,00000001,00000000), ref: 004029A7
                                                                                          • Sleep.KERNEL32(00000002), ref: 004029B1
                                                                                          • keybd_event.USER32(00000009,00000000,00000001,00000000), ref: 004029BB
                                                                                          • Sleep.KERNEL32(00000002), ref: 004029BF
                                                                                          • keybd_event.USER32(00000009,00000000,00000003,00000000), ref: 004029C9
                                                                                          • keybd_event.USER32(000000A4,00000000,00000003,00000000), ref: 004029D6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 4fdc005fdc7bee8c7546a8b6d6a4389bb8a9e1b2051a17712954bd0ce91d13b2
                                                                                          • Instruction ID: 0b5b9c0be6f89da61fea0f823b2fd1c6a9e3b11c2cb1974a7d7702e9325210f2
                                                                                          • Opcode Fuzzy Hash: 4fdc005fdc7bee8c7546a8b6d6a4389bb8a9e1b2051a17712954bd0ce91d13b2
                                                                                          • Instruction Fuzzy Hash: 92F01A36BC03687AF1306B959C0BFD96A14DB88F20F24402AB3083E1C08AE431018AEF
                                                                                          APIs
                                                                                          • keybd_event.USER32(0000005B,00000000,00000001,00000000), ref: 00402AE3
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402AED
                                                                                          • keybd_event.USER32(00000044,00000000,00000001,00000000), ref: 00402AF7
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402AFB
                                                                                          • keybd_event.USER32(00000044,00000000,00000003,00000000), ref: 00402B05
                                                                                          • keybd_event.USER32(0000005B,00000000,00000003,00000000), ref: 00402B0F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: c1a72277dc027a63aa26f83bb71ec2882162e987276d5a8809bf04d7750dee6f
                                                                                          • Instruction ID: 9c5219faef0d582d9198c4e5c334a693a7980fe43f47dfd67b3a34fe3a0cd55b
                                                                                          • Opcode Fuzzy Hash: c1a72277dc027a63aa26f83bb71ec2882162e987276d5a8809bf04d7750dee6f
                                                                                          • Instruction Fuzzy Hash: D8F012317C075C76F5306B559D07FDA7A14D788F20F21402673043E1C08AF831018ADE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 004025EB
                                                                                          • Sleep.KERNEL32(00000002), ref: 004025F5
                                                                                          • keybd_event.USER32(00000043,00000000,00000001,00000000), ref: 004025FF
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402603
                                                                                          • keybd_event.USER32(00000043,00000000,00000003,00000000), ref: 0040260D
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00402617
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: c8a4e9b80ba9b3d4f9b898b18bbe16793acc1dd5fb5a098173ca8f926b9cd82c
                                                                                          • Instruction ID: 971aaf82143ebfe197929046c446da2105366e4125cbbd50dad1aafc5dfc10dc
                                                                                          • Opcode Fuzzy Hash: c8a4e9b80ba9b3d4f9b898b18bbe16793acc1dd5fb5a098173ca8f926b9cd82c
                                                                                          • Instruction Fuzzy Hash: 58F012317C075C76F5346B559C17FD96A14D788F20F20402A73043E1C08AE832418ADE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 004025AA
                                                                                          • Sleep.KERNEL32(00000002), ref: 004025B4
                                                                                          • keybd_event.USER32(00000058,00000000,00000001,00000000), ref: 004025BE
                                                                                          • Sleep.KERNEL32(00000002), ref: 004025C2
                                                                                          • keybd_event.USER32(00000058,00000000,00000003,00000000), ref: 004025CC
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 004025D6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 19129e2db98c29da6ba68b81ca5234146428c125808e4af13c66a9dfa7ed5608
                                                                                          • Instruction ID: 3cb6094350f493bfa29a738d705eab61d7f0a106f6e1109bf66734ccbf6894fd
                                                                                          • Opcode Fuzzy Hash: 19129e2db98c29da6ba68b81ca5234146428c125808e4af13c66a9dfa7ed5608
                                                                                          • Instruction Fuzzy Hash: 39F01A32BC076C76F5746B959C0BFDA6A14D788F20F20802AB7043E1C08AE431459AEE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 0040266D
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402677
                                                                                          • keybd_event.USER32(0000005A,00000000,00000001,00000000), ref: 00402681
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402685
                                                                                          • keybd_event.USER32(0000005A,00000000,00000003,00000000), ref: 0040268F
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00402699
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 44915561d15c87e0eda2c5f2113a26e44937b28c802b3c8534c683717a35a594
                                                                                          • Instruction ID: 3698cbb8d2dacfead1d5d75db7d8e1e71bd7a50ee343c7ee38b0336e31949c87
                                                                                          • Opcode Fuzzy Hash: 44915561d15c87e0eda2c5f2113a26e44937b28c802b3c8534c683717a35a594
                                                                                          • Instruction Fuzzy Hash: B6F01A32BC076C76F5346B959C0BFDA6A14D788F20F20402AB3043E1C08AE431419AEF
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 0040262C
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402636
                                                                                          • keybd_event.USER32(00000056,00000000,00000001,00000000), ref: 00402640
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402644
                                                                                          • keybd_event.USER32(00000056,00000000,00000003,00000000), ref: 0040264E
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00402658
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: d28e51bf866d9ff7bc11ae20fb7cd0f569f7e9bf696b8cff2f02dc219afb2199
                                                                                          • Instruction ID: eb3568243c370323441ab326404959df053c6d7056c32850ce7e47c3979b8c73
                                                                                          • Opcode Fuzzy Hash: d28e51bf866d9ff7bc11ae20fb7cd0f569f7e9bf696b8cff2f02dc219afb2199
                                                                                          • Instruction Fuzzy Hash: 8AF01A32BC076C76F5346B959C0BFDA6A14D788F20F20402AB3043E1C08AE531419AEE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00402705
                                                                                          • Sleep.KERNEL32(00000002), ref: 0040270F
                                                                                          • keybd_event.USER32(0000004E,00000000,00000001,00000000), ref: 00402719
                                                                                          • Sleep.KERNEL32(00000002), ref: 0040271D
                                                                                          • keybd_event.USER32(0000004E,00000000,00000003,00000000), ref: 00402727
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00402731
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: f829472d0affd0f46b8efa8e7f5165bca2f88102c4aa00b0604ba0ecdc184b5f
                                                                                          • Instruction ID: 283fd4befbaf24e1c48da2cc0fb0f56c62b3a2e1b96ce4adb4cd8c246a1154e2
                                                                                          • Opcode Fuzzy Hash: f829472d0affd0f46b8efa8e7f5165bca2f88102c4aa00b0604ba0ecdc184b5f
                                                                                          • Instruction Fuzzy Hash: F4F012317C075C76F5346B559C07FD96A14EB88F20F20402673043E1C08AE831418ADE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 004026AE
                                                                                          • Sleep.KERNEL32(00000002), ref: 004026B8
                                                                                          • keybd_event.USER32(00000041,00000000,00000001,00000000), ref: 004026C2
                                                                                          • Sleep.KERNEL32(00000002), ref: 004026C6
                                                                                          • keybd_event.USER32(00000041,00000000,00000003,00000000), ref: 004026D0
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 004026DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: e93c9b625a9b515c2a78db762b715d29a75c2ccf4e41d36aa8f02ad9659a5e5d
                                                                                          • Instruction ID: 3a3d877444acc22c109d5c82ca8c4d61a08fb138118514743143cfb357464009
                                                                                          • Opcode Fuzzy Hash: e93c9b625a9b515c2a78db762b715d29a75c2ccf4e41d36aa8f02ad9659a5e5d
                                                                                          • Instruction Fuzzy Hash: EBF012317C075C76F5346B559C07FD96A14D788F20F20402673043E1C18AE831818ADE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00402787
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402791
                                                                                          • keybd_event.USER32(00000053,00000000,00000001,00000000), ref: 0040279B
                                                                                          • Sleep.KERNEL32(00000002), ref: 0040279F
                                                                                          • keybd_event.USER32(00000053,00000000,00000003,00000000), ref: 004027A9
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 004027B3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 91ba9f8762cbaed39bede39a0e0a33e597b473e9d174dc22e521d1ade416e221
                                                                                          • Instruction ID: 38b5a1f1e909b859148a1810107c2283d0bfdabbb2d2f0cab59f3884aa1c4f5c
                                                                                          • Opcode Fuzzy Hash: 91ba9f8762cbaed39bede39a0e0a33e597b473e9d174dc22e521d1ade416e221
                                                                                          • Instruction Fuzzy Hash: 6CF01A32BC076C7AF5346B959C1BFDA6A14D788F20F20802AB3047E1C08AE431419AEE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00402746
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402750
                                                                                          • keybd_event.USER32(00000050,00000000,00000001,00000000), ref: 0040275A
                                                                                          • Sleep.KERNEL32(00000002), ref: 0040275E
                                                                                          • keybd_event.USER32(00000050,00000000,00000003,00000000), ref: 00402768
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00402772
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 9d2546491847668472809964f49d9f4b461cb8854a7b5a23751962bd6ecc6bc7
                                                                                          • Instruction ID: e36a0b5fabe7589b18d76afe3c0aee142628f5167394c791d73dc15dee76e952
                                                                                          • Opcode Fuzzy Hash: 9d2546491847668472809964f49d9f4b461cb8854a7b5a23751962bd6ecc6bc7
                                                                                          • Instruction Fuzzy Hash: 14F01A32BC076C76F5746B959D0BFDA6A14D788F20F20402AB3043E1C08AE431419AEE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 00402809
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402813
                                                                                          • keybd_event.USER32(00000059,00000000,00000001,00000000), ref: 0040281D
                                                                                          • Sleep.KERNEL32(00000002), ref: 00402821
                                                                                          • keybd_event.USER32(00000059,00000000,00000003,00000000), ref: 0040282B
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 00402835
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: 542cbf4e5c4457636522fcb54899307d1c991548f11a48d0666a6b34df0bfc9b
                                                                                          • Instruction ID: 07f27b0241492d38d02dfc6c978a3ed16b5b22be644420e64bc6882782e328a3
                                                                                          • Opcode Fuzzy Hash: 542cbf4e5c4457636522fcb54899307d1c991548f11a48d0666a6b34df0bfc9b
                                                                                          • Instruction Fuzzy Hash: 06F012317C075CB6F5346B559C07FD96A14D788F20F24402673043E1C08AE431419ADE
                                                                                          APIs
                                                                                          • keybd_event.USER32(00000011,00000000,00000001,00000000), ref: 004027C8
                                                                                          • Sleep.KERNEL32(00000002), ref: 004027D2
                                                                                          • keybd_event.USER32(0000004F,00000000,00000001,00000000), ref: 004027DC
                                                                                          • Sleep.KERNEL32(00000002), ref: 004027E0
                                                                                          • keybd_event.USER32(0000004F,00000000,00000003,00000000), ref: 004027EA
                                                                                          • keybd_event.USER32(00000011,00000000,00000003,00000000), ref: 004027F4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: keybd_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1412104608-0
                                                                                          • Opcode ID: beb452d796fb684be5e27b5f0713e0b1cb59b9266c90a83828659888a830ca61
                                                                                          • Instruction ID: 417618918b7df4168bc84748da863cbcc4f63883c43cf9d290316b2c8b3760d6
                                                                                          • Opcode Fuzzy Hash: beb452d796fb684be5e27b5f0713e0b1cb59b9266c90a83828659888a830ca61
                                                                                          • Instruction Fuzzy Hash: 77F01A32BC076C76F5746B959C0BFE96A14D788F20F20403AB3083E1C18AE831418AEE
                                                                                          APIs
                                                                                          • GetVersionExA.KERNEL32 ref: 10001AF7
                                                                                          • GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 10001B2C
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10001B8C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: EnvironmentFileModuleNameVariableVersion
                                                                                          • String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
                                                                                          • API String ID: 1385375860-4131005785
                                                                                          • Opcode ID: 4cdc7b00275eb152e7e45da68d01c673b3525a54971115f8ba5ed965abcc7f85
                                                                                          • Instruction ID: 49562ee88c4c25205948683e74cca6eccce969698ffcaf9d7296f8a74874bf19
                                                                                          • Opcode Fuzzy Hash: 4cdc7b00275eb152e7e45da68d01c673b3525a54971115f8ba5ed965abcc7f85
                                                                                          • Instruction Fuzzy Hash: 30310171D852886AFB21C7B09C95BDE37E8DB063C4F6000E9D186D604AF731DE89CB61
                                                                                          APIs
                                                                                          • SendMessageW.USER32(00000000,00000433,00000000,?), ref: 00412C43
                                                                                          • GetWindowLongW.USER32(?,000000FC), ref: 00412C54
                                                                                          • GetWindowLongW.USER32(?,000000FC), ref: 00412C64
                                                                                          • SetWindowLongW.USER32(?,000000FC,?), ref: 00412C80
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: LongWindow$MessageSend
                                                                                          • String ID: (
                                                                                          • API String ID: 2178440468-3887548279
                                                                                          • Opcode ID: a395be2165c4df98350eee2dbbee1b3594711a861ecf7f687db322306461cfb2
                                                                                          • Instruction ID: 8127b8eb62a3600f624f383f125ff90b15564d459b34ef4b54309d17c31cee8f
                                                                                          • Opcode Fuzzy Hash: a395be2165c4df98350eee2dbbee1b3594711a861ecf7f687db322306461cfb2
                                                                                          • Instruction Fuzzy Hash: ED31C3716047049FDB20AF65CA84AEEB7F4BF48314F14422FE541D7291DBB9E8A0CB98
                                                                                          APIs
                                                                                          • PostMessageA.USER32(?,00001402,?,?), ref: 021B13BF
                                                                                          • CallNextHookEx.USER32(?,?,?,?), ref: 021B13CF
                                                                                          • PostMessageA.USER32(?,00001401,?,?), ref: 021B142D
                                                                                          • CallNextHookEx.USER32(00000000,?,?,?), ref: 021B1450
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CallHookMessageNextPost
                                                                                          • String ID: ms %x
                                                                                          • API String ID: 1949595931-576526061
                                                                                          • Opcode ID: 19f704a4abace90a994dc0caf749ba8c03c4137b64fa3247767088c6c6291522
                                                                                          • Instruction ID: 893c3294b8d7676dc653896f4cee61da73da932e962c94bb3a3f7b8ebfad1bc9
                                                                                          • Opcode Fuzzy Hash: 19f704a4abace90a994dc0caf749ba8c03c4137b64fa3247767088c6c6291522
                                                                                          • Instruction Fuzzy Hash: F231C432D80364F6DB37660AD89CBEBB7B89F85324F064836E9AC63591D3255890C6A1
                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 0041980F
                                                                                            • Part of subcall function 004198FD: lstrlenW.KERNEL32(?,00419840,?,?), ref: 00419931
                                                                                          • lstrcpyW.KERNEL32(?,.HLP,?,?,00000104), ref: 004198B0
                                                                                          • lstrcatW.KERNEL32(?,.INI,?,?,00000104), ref: 004198DF
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileModuleNamelstrcatlstrcpylstrlen
                                                                                          • String ID: .HLP$.INI
                                                                                          • API String ID: 2421895198-3011182340
                                                                                          • Opcode ID: 177f320bc6e2431b0dfb20c3030ac211aa2bac01620984dd3cb5f2b8cb6eddef
                                                                                          • Instruction ID: cbd35fc5cae172468727477129e021bde068fd7a356bc138f45f819f180a916f
                                                                                          • Opcode Fuzzy Hash: 177f320bc6e2431b0dfb20c3030ac211aa2bac01620984dd3cb5f2b8cb6eddef
                                                                                          • Instruction Fuzzy Hash: F3314CB1900719AEDB20EF65D885AC6B7F8EB48304F1048BBE159E3151DB34A984CF69
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: wsprintf$ClassInfo
                                                                                          • String ID: Afx:%x:%x$Afx:%x:%x:%x:%x:%x
                                                                                          • API String ID: 845911565-79760390
                                                                                          • Opcode ID: 14d9707b6db45db4c3dab0b6e6a3b49db6d309ff8e536fa7dd8ea927d7a402c2
                                                                                          • Instruction ID: 4557ca851c6f6c2fa06855691b30b84a2f616c6377534134ec289b860dc59257
                                                                                          • Opcode Fuzzy Hash: 14d9707b6db45db4c3dab0b6e6a3b49db6d309ff8e536fa7dd8ea927d7a402c2
                                                                                          • Instruction Fuzzy Hash: D7213E71900219AF8F10DF99DD849EFBFF8EF48345B04402BF908A2211E7349A91CBA9
                                                                                          APIs
                                                                                          • GetStartupInfoA.KERNEL32(?), ref: 100014C1
                                                                                          • GetFileType.KERNEL32(00000480), ref: 1000156C
                                                                                          • GetStdHandle.KERNEL32(-000000F6), ref: 100015CF
                                                                                          • GetFileType.KERNEL32(00000000), ref: 100015DD
                                                                                          • SetHandleCount.KERNEL32 ref: 10001614
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleType$CountInfoStartup
                                                                                          • String ID:
                                                                                          • API String ID: 1710529072-0
                                                                                          • Opcode ID: 84deabbc8482cf90d0afbbdb1ff487318f5365f0c05ff7443d7b3574e5abf5e2
                                                                                          • Instruction ID: 53baed3e009aff7af052c5f488337fc3205a616cff54666c456afc8db5ee0fa4
                                                                                          • Opcode Fuzzy Hash: 84deabbc8482cf90d0afbbdb1ff487318f5365f0c05ff7443d7b3574e5abf5e2
                                                                                          • Instruction Fuzzy Hash: 64510171A04A52CFF710CB28CC887993BE4FB853EAF258668D5928B2E9D730D945C741
                                                                                          APIs
                                                                                          • GetStartupInfoA.KERNEL32(?), ref: 0040B8BE
                                                                                          • GetFileType.KERNEL32(?,?,00000000), ref: 0040B969
                                                                                          • GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 0040B9CC
                                                                                          • GetFileType.KERNEL32(00000000,?,00000000), ref: 0040B9DA
                                                                                          • SetHandleCount.KERNEL32 ref: 0040BA11
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleType$CountInfoStartup
                                                                                          • String ID:
                                                                                          • API String ID: 1710529072-0
                                                                                          • Opcode ID: c3c0d4121423bddf831dcc3d5ac240f2462ab89979abcb2e4088ebd5d89ca60d
                                                                                          • Instruction ID: 9d65097b77b8f2f8dd7e28cf4c930ebc3f1b7ccaf5fcbcdebabd200cb16f865e
                                                                                          • Opcode Fuzzy Hash: c3c0d4121423bddf831dcc3d5ac240f2462ab89979abcb2e4088ebd5d89ca60d
                                                                                          • Instruction Fuzzy Hash: 7E512AB15106058FC720DF38C88476A77E0EB12328F25867ED696A73E2DB389806C7DD
                                                                                          APIs
                                                                                          • GetStartupInfoA.KERNEL32(?), ref: 021B2295
                                                                                          • GetFileType.KERNEL32(00000480), ref: 021B2340
                                                                                          • GetStdHandle.KERNEL32(-000000F6), ref: 021B23A3
                                                                                          • GetFileType.KERNEL32(00000000), ref: 021B23B1
                                                                                          • SetHandleCount.KERNEL32 ref: 021B23E8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleType$CountInfoStartup
                                                                                          • String ID:
                                                                                          • API String ID: 1710529072-0
                                                                                          • Opcode ID: 62605e5323c02693afafdb61df6d02601825885c6c813765f496c879a6f60d82
                                                                                          • Instruction ID: 26e7546ad43d5043b7e2312d82ec8961c7bae346d8cc2d6aed955801ad25508d
                                                                                          • Opcode Fuzzy Hash: 62605e5323c02693afafdb61df6d02601825885c6c813765f496c879a6f60d82
                                                                                          • Instruction Fuzzy Hash: A651E431D886018FC727CB38C4947AB77F4EF1A368F254A68D9A29B2F0D734944ACB50
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00412FBF
                                                                                          • GetClassInfoW.USER32(?,?,?), ref: 00412FDA
                                                                                          • RegisterClassW.USER32(?), ref: 00412FE5
                                                                                          • lstrcatW.KERNEL32(00000034,?,00000001), ref: 0041301C
                                                                                          • lstrcatW.KERNEL32(00000034,?), ref: 0041302D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Classlstrcat$H_prologInfoRegister
                                                                                          • String ID:
                                                                                          • API String ID: 106226465-0
                                                                                          • Opcode ID: 9a15280f8081f9071a6eaf4f6dd43540c8b551fd3066ad33aef73722d2375ec3
                                                                                          • Instruction ID: 0b49571dc8f6f6af560e57779b463446e08f748a62ecb72f5e1f4a0609a6aaad
                                                                                          • Opcode Fuzzy Hash: 9a15280f8081f9071a6eaf4f6dd43540c8b551fd3066ad33aef73722d2375ec3
                                                                                          • Instruction Fuzzy Hash: A6110876900304BECB10AFA0DD41ADE7BB8FF05754F00851FF806A7151C778968087A9
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000103,7FFFFFFF,10004585,10002D83,00000000,?,?,00000000,00000001), ref: 1000135E
                                                                                          • TlsGetValue.KERNEL32 ref: 1000136C
                                                                                          • SetLastError.KERNEL32(00000000), ref: 100013B8
                                                                                            • Part of subcall function 10001FBC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,10004110,100053F0,000000FF,?,10001381,00000001,00000074), ref: 100020B2
                                                                                          • TlsSetValue.KERNEL32(00000000), ref: 10001390
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 100013A1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLastValue$AllocCurrentHeapThread
                                                                                          • String ID:
                                                                                          • API String ID: 2020098873-0
                                                                                          • Opcode ID: 4a59be858dacc42556b132797167ab9f0e56b8fa3426ab5e884bc570b56e8525
                                                                                          • Instruction ID: 478302e9adfb350e7bc37bafe85eadd542bbdb1a9d691e3d3394f36d401788a0
                                                                                          • Opcode Fuzzy Hash: 4a59be858dacc42556b132797167ab9f0e56b8fa3426ab5e884bc570b56e8525
                                                                                          • Instruction Fuzzy Hash: 16F024369016316BF6305B309C8D69F3AE4DF057F3B110228FA80DA2ECCB21890096E1
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000000,0000000C,0040AF5A,00000000,0000000C,?,0040AF32,00000000,00000000,?,?,0040AD63,00000000,00000001), ref: 0040BA85
                                                                                          • TlsGetValue.KERNEL32(?,0040AF32,00000000,00000000,?,?,0040AD63,00000000,00000001), ref: 0040BA93
                                                                                          • SetLastError.KERNEL32(00000000,?,0040AF32,00000000,00000000,?,?,0040AD63,00000000,00000001), ref: 0040BADF
                                                                                            • Part of subcall function 0040E432: HeapAlloc.KERNEL32(00000008,?,?,?,?,0040BA3B,00000001,00000074,?,0040972E), ref: 0040E487
                                                                                          • TlsSetValue.KERNEL32(00000000,?,0040AF32,00000000,00000000,?,?,0040AD63,00000000,00000001), ref: 0040BAB7
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0040BAC8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLastValue$AllocCurrentHeapThread
                                                                                          • String ID:
                                                                                          • API String ID: 2020098873-0
                                                                                          • Opcode ID: 37b7c1b7b914de8b7f453ca6443949566849e14104e2525a80ab8c3346751875
                                                                                          • Instruction ID: 96ada6c0124a5ac05054c1f6b6abd646f1abf23492f88248f65bb3fac04838e5
                                                                                          • Opcode Fuzzy Hash: 37b7c1b7b914de8b7f453ca6443949566849e14104e2525a80ab8c3346751875
                                                                                          • Instruction Fuzzy Hash: 17F02B32700211AFD7302B35AC0D69A3A50EF017B1700453AF856A62E1DBB888418ADC
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000001,?,021B4676,021B2BE6,?,021B175B,?,?,00000001,?,?,?,?,021B1EE6,?,?), ref: 021B2132
                                                                                          • TlsGetValue.KERNEL32(?,021B1EE6,?,?,?,021B195E,021B149E,?,021B149E), ref: 021B2140
                                                                                          • SetLastError.KERNEL32(00000000,?,021B1EE6,?,?,?,021B195E,021B149E,?,021B149E), ref: 021B218C
                                                                                            • Part of subcall function 021B3290: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,?,021B2155,00000001,00000074,?,021B1EE6,?,?,?,021B195E,021B149E,?), ref: 021B32E5
                                                                                          • TlsSetValue.KERNEL32(00000000,?,021B1EE6,?,?,?,021B195E,021B149E,?,021B149E), ref: 021B2164
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 021B2175
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLastValue$AllocCurrentHeapThread
                                                                                          • String ID:
                                                                                          • API String ID: 2020098873-0
                                                                                          • Opcode ID: a1f469759a1ce0881fe76ecfb96380e6878782e079fe872b7fe54cba3a88a4ab
                                                                                          • Instruction ID: 33cc70e932b48b0dabb0cad3618b1cd3854558430169ab43a5033d4d185af923
                                                                                          • Opcode Fuzzy Hash: a1f469759a1ce0881fe76ecfb96380e6878782e079fe872b7fe54cba3a88a4ab
                                                                                          • Instruction Fuzzy Hash: 2DF0BB32DC1252ABD7332B75F84879B7BF8AF457B17154B25FA51DA1C0CB7084928A90
                                                                                          APIs
                                                                                          • VirtualFree.KERNEL32(026305C4,00100000,00004000,?,?,?,?,021B1587,021B15DB,?,?,?), ref: 021B28E9
                                                                                          • VirtualFree.KERNEL32(026305C4,00000000,00008000,?,?,021B1587,021B15DB,?,?,?), ref: 021B28F4
                                                                                          • HeapFree.KERNEL32(00000000,?,?,?,021B1587,021B15DB,?,?,?), ref: 021B2901
                                                                                          • HeapFree.KERNEL32(00000000,?,?,021B1587,021B15DB,?,?,?), ref: 021B291F
                                                                                          • HeapDestroy.KERNEL32(?,?,021B1587,021B15DB,?,?,?), ref: 021B2927
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Free$Heap$Virtual$Destroy
                                                                                          • String ID:
                                                                                          • API String ID: 782257640-0
                                                                                          • Opcode ID: abb388b180f2e64d7886993ee3d3f80ec7110f9f7ac1f24aa752ed6bf066358b
                                                                                          • Instruction ID: dc85185caad15b7e6caf371a9e4cf8bdea92d50949291fcb043e665ea8733e0a
                                                                                          • Opcode Fuzzy Hash: abb388b180f2e64d7886993ee3d3f80ec7110f9f7ac1f24aa752ed6bf066358b
                                                                                          • Instruction Fuzzy Hash: 71F04F36980245EFDB236F62FC45F577BB9EB44B50F224864F744160A0877268A5DF28
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(004466E8,?,00000000,?,?,0041922B,00000010,?,00000000,?,?,?,004189F6,Vht ,00418139,004189FC), ref: 00419645
                                                                                          • InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,0041922B,00000010,?,00000000,?,?,?,004189F6,Vht ,00418139,004189FC), ref: 00419657
                                                                                          • LeaveCriticalSection.KERNEL32(004466E8,?,00000000,?,?,0041922B,00000010,?,00000000,?,?,?,004189F6,Vht ,00418139,004189FC), ref: 00419660
                                                                                          • EnterCriticalSection.KERNEL32(00000000,00000000,?,?,0041922B,00000010,?,00000000,?,?,?,004189F6,Vht ,00418139,004189FC,004154AA), ref: 00419672
                                                                                            • Part of subcall function 00419577: GetVersion.KERNEL32(?,0041961A,?,0041922B,00000010,?,00000000,?,?,?,004189F6,Vht ,00418139,004189FC,004154AA,00416C26), ref: 0041958A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$Enter$InitializeLeaveVersion
                                                                                          • String ID: fD
                                                                                          • API String ID: 1193629340-2787630388
                                                                                          • Opcode ID: 6265407ecd40385fe4eb73274f8079ff940630c3dc71f7ecef41a7b92ccaddbb
                                                                                          • Instruction ID: 650cb7c07f04675726c201083a3a7375179f04c550e7a089c3bce5061d5d0676
                                                                                          • Opcode Fuzzy Hash: 6265407ecd40385fe4eb73274f8079ff940630c3dc71f7ecef41a7b92ccaddbb
                                                                                          • Instruction Fuzzy Hash: 9CF0447540120AEFDB109F65FC94997B3ADFB17319B424437D60942111D739B894CEBD
                                                                                          APIs
                                                                                          • TlsFree.KERNEL32(00000000,?,?,004192C4,00000000,00000001), ref: 00418DC3
                                                                                          • GlobalHandle.KERNEL32(00621FB0), ref: 00418DEB
                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00418DF4
                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00418DFB
                                                                                          • DeleteCriticalSection.KERNEL32(004465A4,?,?,004192C4,00000000,00000001), ref: 00418E05
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$Free$CriticalDeleteHandleSectionUnlock
                                                                                          • String ID:
                                                                                          • API String ID: 2159622880-0
                                                                                          • Opcode ID: edb0ce47d3a0cd07400f61eef27101caee41fbdadbf33e68775b0eb23b094476
                                                                                          • Instruction ID: 4326c19dda08d5ea5737c35ce0fc81d5bc9102a229e0d705be6dd01396519ed5
                                                                                          • Opcode Fuzzy Hash: edb0ce47d3a0cd07400f61eef27101caee41fbdadbf33e68775b0eb23b094476
                                                                                          • Instruction Fuzzy Hash: 85F05E35700710ABD6209F39AC4CAAF76ADEF9875071A452EF815D32A0DF78DC4286A8
                                                                                          APIs
                                                                                          • DeleteCriticalSection.KERNEL32(00000000,?,?,10001330,100010D0,10001129,?,?,?), ref: 10001F0E
                                                                                            • Part of subcall function 100020F9: HeapFree.KERNEL32(00000000,?,?,?,?), ref: 100021CD
                                                                                          • DeleteCriticalSection.KERNEL32(?,?,10001330,100010D0,10001129,?,?,?), ref: 10001F29
                                                                                          • DeleteCriticalSection.KERNEL32 ref: 10001F31
                                                                                          • DeleteCriticalSection.KERNEL32 ref: 10001F39
                                                                                          • DeleteCriticalSection.KERNEL32 ref: 10001F41
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalDeleteSection$FreeHeap
                                                                                          • String ID:
                                                                                          • API String ID: 447823528-0
                                                                                          • Opcode ID: ca930b65f3d23fc5fcf3164c9b941d63f09f7cbdaa7a0f119b38062c78b48038
                                                                                          • Instruction ID: 2b47a9b38ca03f0a2d89d83dee0abff607f2ed65e3b7deccfd60a212b6451749
                                                                                          • Opcode Fuzzy Hash: ca930b65f3d23fc5fcf3164c9b941d63f09f7cbdaa7a0f119b38062c78b48038
                                                                                          • Instruction Fuzzy Hash: 10F08232C402B2B6FB70F719DD998EB7AD3DBC82D03660071D9816217FC6164C5089E0
                                                                                          APIs
                                                                                          • DeleteCriticalSection.KERNEL32(00000000,?,?,021B2104,021B1582,021B15DB,?,?,?), ref: 021B31E2
                                                                                          • DeleteCriticalSection.KERNEL32(?,?,021B2104,021B1582,021B15DB,?,?,?), ref: 021B31FD
                                                                                          • DeleteCriticalSection.KERNEL32 ref: 021B3205
                                                                                          • DeleteCriticalSection.KERNEL32 ref: 021B320D
                                                                                          • DeleteCriticalSection.KERNEL32 ref: 021B3215
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalDeleteSection
                                                                                          • String ID:
                                                                                          • API String ID: 166494926-0
                                                                                          • Opcode ID: 822c959e130a29cead8ad83e31d3f0c293a0f40c3a8dd9bd032830fe12ee0f1e
                                                                                          • Instruction ID: 62eb26ebb15741fc3d50b9f4563cb3bb05ea760b4685d0d946975a7ab72b0f84
                                                                                          • Opcode Fuzzy Hash: 822c959e130a29cead8ad83e31d3f0c293a0f40c3a8dd9bd032830fe12ee0f1e
                                                                                          • Instruction Fuzzy Hash: 61F0F423CC006096D9373A2EAD488DBEEBD9EE131430608F2D868631B087139CB6C9E1
                                                                                          APIs
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403978
                                                                                          • mouse_event.USER32(00000080,00000000,00000000,00000001,00000000), ref: 0040398C
                                                                                          • Sleep.KERNEL32(00000002,?,?,00402529,?,00000002), ref: 00403990
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403996
                                                                                          • mouse_event.USER32(00000100,00000000,00000000,00000001,00000000), ref: 004039A4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExtraInfoMessagemouse_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1081616411-0
                                                                                          • Opcode ID: 855580bac61a730e7fb19ea4213266fc5fe63f0d352b3dcc46e4a9d2e255bdb3
                                                                                          • Instruction ID: f177708ff9e1bf83c0bacd60d204673e604890316f9965e06022afe51c320911
                                                                                          • Opcode Fuzzy Hash: 855580bac61a730e7fb19ea4213266fc5fe63f0d352b3dcc46e4a9d2e255bdb3
                                                                                          • Instruction Fuzzy Hash: 5EE0673279032876F66127956C4BFEA2A5DDB88F21F218062F700AA0D0CAD028554AA9
                                                                                          APIs
                                                                                          • GetMessageExtraInfo.USER32 ref: 004039B8
                                                                                          • mouse_event.USER32(00000080,00000000,00000000,00000002,00000000), ref: 004039CC
                                                                                          • Sleep.KERNEL32(00000002,?,?,00402533,?,00000002), ref: 004039D0
                                                                                          • GetMessageExtraInfo.USER32 ref: 004039D6
                                                                                          • mouse_event.USER32(00000100,00000000,00000000,00000002,00000000), ref: 004039E4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExtraInfoMessagemouse_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1081616411-0
                                                                                          • Opcode ID: c62b053fb0a8031979b1cde18961b8705170a48855d0645d5581dd86f2651668
                                                                                          • Instruction ID: 6bff3c6f8f87c4f43b81dd05ba049a17c7855ad4be10d981366b387ec6b9a2da
                                                                                          • Opcode Fuzzy Hash: c62b053fb0a8031979b1cde18961b8705170a48855d0645d5581dd86f2651668
                                                                                          • Instruction Fuzzy Hash: 27E09E327C032876F26127957C0BFAE2A5CDBC8F21F618062F700BE0D18AD02C554AF9
                                                                                          APIs
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403318
                                                                                          • mouse_event.USER32(00000020,00000000,00000000,00000000,00000000), ref: 00403329
                                                                                          • Sleep.KERNEL32(00000002,?,?,004024F7), ref: 0040332D
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403333
                                                                                          • mouse_event.USER32(00000040,00000000,00000000,00000000,00000000), ref: 0040333E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExtraInfoMessagemouse_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1081616411-0
                                                                                          • Opcode ID: 0b7616d9d236eae564ccb447fc6d654e4e31324b3f4521c3222ea65f16b9d486
                                                                                          • Instruction ID: 09995f48b8fa2d87d33d7b7dffc0a380c5f75740f079ce5a56464f2603f73e08
                                                                                          • Opcode Fuzzy Hash: 0b7616d9d236eae564ccb447fc6d654e4e31324b3f4521c3222ea65f16b9d486
                                                                                          • Instruction Fuzzy Hash: 82E0677278032876F16027956C0BFAA2A5CDB84F21F214062F704BA0D086E038154AAD
                                                                                          APIs
                                                                                          • GetMessageExtraInfo.USER32 ref: 004037E8
                                                                                          • mouse_event.USER32(00000008,00000000,00000000,00000000,00000000), ref: 004037F9
                                                                                          • Sleep.KERNEL32(00000001,?,?,004024ED), ref: 004037FD
                                                                                          • GetMessageExtraInfo.USER32 ref: 00403803
                                                                                          • mouse_event.USER32(00000010,00000000,00000000,00000000,00000000), ref: 0040380E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExtraInfoMessagemouse_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1081616411-0
                                                                                          • Opcode ID: d71ff6fdb3d1b4139f44ba0fc86d93803d3798a4b0e91c5fb4c0c5a7196ae7c4
                                                                                          • Instruction ID: 05f0f3f8a2681ba104d1943d308353dedcb2e52bade23884ebf2e9292700a309
                                                                                          • Opcode Fuzzy Hash: d71ff6fdb3d1b4139f44ba0fc86d93803d3798a4b0e91c5fb4c0c5a7196ae7c4
                                                                                          • Instruction Fuzzy Hash: 1EE067327803187AF66027956C06FAA2A58DBC4F21F218062F704AA0D08AD038554AE9
                                                                                          APIs
                                                                                          • GetMessageExtraInfo.USER32 ref: 004037A8
                                                                                          • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 004037B9
                                                                                          • Sleep.KERNEL32(00000001), ref: 004037BD
                                                                                          • GetMessageExtraInfo.USER32 ref: 004037C3
                                                                                          • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 004037CE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExtraInfoMessagemouse_event$Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 1081616411-0
                                                                                          • Opcode ID: d212a1a73e5a68e83fddcb149ad228ef7c48faa9b89bdf4d8505a4d69d0afbea
                                                                                          • Instruction ID: ff79d92384f923dedc0603ee89b016f54226f71a5e1135626e7db83205b08f88
                                                                                          • Opcode Fuzzy Hash: d212a1a73e5a68e83fddcb149ad228ef7c48faa9b89bdf4d8505a4d69d0afbea
                                                                                          • Instruction Fuzzy Hash: E8E067727803287AF22027956C0BFAA2A5CDB84F21F214062B704AA0D086E038554AED
                                                                                          APIs
                                                                                          • wsprintfW.USER32 ref: 00405AB5
                                                                                          • OutputDebugStringW.KERNEL32(?), ref: 00405AC3
                                                                                          • PostMessageW.USER32(?,0000052D,0000000E,00000003), ref: 00405BFD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DebugMessageOutputPostStringwsprintf
                                                                                          • String ID: wParam=%x,lParam=%x
                                                                                          • API String ID: 2045784622-718613613
                                                                                          • Opcode ID: 457ee708423077e8caf5f4b15b52a6d4c730a9eb31ae1afc5a03317a8e944a08
                                                                                          • Instruction ID: d1813fa9bd7fdb6c6f40d63624e8afcba2955b495607b3672609d09f5c175e97
                                                                                          • Opcode Fuzzy Hash: 457ee708423077e8caf5f4b15b52a6d4c730a9eb31ae1afc5a03317a8e944a08
                                                                                          • Instruction Fuzzy Hash: 8631FE72F84B106AEA304904CC86F6B3229DB65F10F514533FA557E2C5D2BCF9815FAA
                                                                                          APIs
                                                                                          • GetMenuCheckMarkDimensions.USER32 ref: 004181DA
                                                                                          • CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 00418289
                                                                                          • LoadBitmapW.USER32(00000000,00007FE3), ref: 004182A1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
                                                                                          • String ID:
                                                                                          • API String ID: 2596413745-3916222277
                                                                                          • Opcode ID: 688f917c973aeecee0aaae51f51699ac74693944f3b6a3b006593f79132ac423
                                                                                          • Instruction ID: d7cd24692bdf7dd9b1fcdba990149b50cb700dc0afc70ce1df07f46d1fa47927
                                                                                          • Opcode Fuzzy Hash: 688f917c973aeecee0aaae51f51699ac74693944f3b6a3b006593f79132ac423
                                                                                          • Instruction Fuzzy Hash: F8214C72E40315AFDB10CF78DC89BEE7BB5EB44704F0541AAE505EB2C2D7749A448B84
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: H_prolog
                                                                                          • String ID: _D$`_D$_D
                                                                                          • API String ID: 3519838083-1080021210
                                                                                          • Opcode ID: 3e1541674242b95c857ee855e871e2f952d1fee6f2cde56ec874071deb961eec
                                                                                          • Instruction ID: 4500186b217231df2a7c81e7b7a780dd88a7e2cbeec2a2d833dfab28989d6237
                                                                                          • Opcode Fuzzy Hash: 3e1541674242b95c857ee855e871e2f952d1fee6f2cde56ec874071deb961eec
                                                                                          • Instruction Fuzzy Hash: 1A017C71A05610CFDB389F1883487EAB3E4AB04711F04416FA496D7691C3FCAC94CA8E
                                                                                          APIs
                                                                                          • InterlockedIncrement.KERNEL32(00446FAC), ref: 0040FC40
                                                                                          • InterlockedDecrement.KERNEL32(00446FAC), ref: 0040FC57
                                                                                            • Part of subcall function 0040D773: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0040E468,00000009,?,?,?,0040BA3B,00000001,00000074,?,0040972E), ref: 0040D7B0
                                                                                            • Part of subcall function 0040D773: EnterCriticalSection.KERNEL32(?,?,?,0040E468,00000009,?,?,?,0040BA3B,00000001,00000074,?,0040972E), ref: 0040D7CB
                                                                                          • InterlockedDecrement.KERNEL32(00446FAC), ref: 0040FC87
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
                                                                                          • String ID: z@
                                                                                          • API String ID: 2038102319-317290069
                                                                                          • Opcode ID: d4dcdcbb2150f5de0099b27f15e0fdb9fd6d19073ab76e3ce3ef45185dfa23ff
                                                                                          • Instruction ID: c4d84d4cfb7ab0d4afc8027cb893d5032d14dc98e04d10461e7ab2effec0d995
                                                                                          • Opcode Fuzzy Hash: d4dcdcbb2150f5de0099b27f15e0fdb9fd6d19073ab76e3ce3ef45185dfa23ff
                                                                                          • Instruction Fuzzy Hash: 64F0B43250420DBFFB216F91AC86DDB3768FF45354F05003BF90026590D7B6491A969D
                                                                                          APIs
                                                                                          • SHGetSpecialFolderLocation.SHELL32(00000000,00000011,?), ref: 004020B4
                                                                                          • ShellExecuteExW.SHELL32 ref: 0040210F
                                                                                          • SHGetMalloc.SHELL32(?), ref: 0040211A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExecuteFolderLocationMallocShellSpecial
                                                                                          • String ID: <
                                                                                          • API String ID: 2342434566-4251816714
                                                                                          • Opcode ID: 372bca3eebe1cff60bec182b52efa1105f20e5759d95643ff3743f0d33354d68
                                                                                          • Instruction ID: 0763a2419ee2dbe53667a5b5525f45861b6eef1a097d4743fe39817fdb7a52c1
                                                                                          • Opcode Fuzzy Hash: 372bca3eebe1cff60bec182b52efa1105f20e5759d95643ff3743f0d33354d68
                                                                                          • Instruction Fuzzy Hash: C601C2B01083419FE340CF40D588B9BBBE8FB88708F00896DF1858B2A0C7B99509CF96
                                                                                          APIs
                                                                                          • SHGetSpecialFolderLocation.SHELL32(00000000,00000011,?), ref: 00402A37
                                                                                          • ShellExecuteExW.SHELL32 ref: 00402A92
                                                                                          • SHGetMalloc.SHELL32(?), ref: 00402A9D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExecuteFolderLocationMallocShellSpecial
                                                                                          • String ID: <
                                                                                          • API String ID: 2342434566-4251816714
                                                                                          • Opcode ID: c049ed640f476c573db559f9ef13b983dec756573723d712759d551927e6d974
                                                                                          • Instruction ID: 1e19fee4f5b24bf4d45a1c53b0ef7dda58290a693df05c1043bb1039b65b79c0
                                                                                          • Opcode Fuzzy Hash: c049ed640f476c573db559f9ef13b983dec756573723d712759d551927e6d974
                                                                                          • Instruction Fuzzy Hash: 5201C2B0108345EFE344CF00D488B9BBBF4FB88708F00892DF1899A2A0D7B99549CF96
                                                                                          APIs
                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 0041723E
                                                                                          • GetClassNameW.USER32(00000000,?,0000000A), ref: 00417259
                                                                                          • lstrcmpiW.KERNEL32(?,combobox), ref: 00417268
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClassLongNameWindowlstrcmpi
                                                                                          • String ID: combobox
                                                                                          • API String ID: 2054663530-2240613097
                                                                                          • Opcode ID: 3facfdd509dfdcc690d19692d7fcbd9a859eff4346654b641270c012a0242a54
                                                                                          • Instruction ID: fc8e16252a47da76d99fac53a12058a17b6bb4d8113212bfdf0715c655653c92
                                                                                          • Opcode Fuzzy Hash: 3facfdd509dfdcc690d19692d7fcbd9a859eff4346654b641270c012a0242a54
                                                                                          • Instruction Fuzzy Hash: 21E0653155410DBBCF11AF64CD4AEEB3BB8EB14345F108222B412D51A1D738E585C6E9
                                                                                          APIs
                                                                                          • GetForegroundWindow.USER32 ref: 004028D8
                                                                                          • GetClassNameW.USER32(00000000,?,00000064), ref: 004028E8
                                                                                          • PostMessageW.USER32(00000000,00000112,0000F030,00000000), ref: 00402915
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClassForegroundMessageNamePostWindow
                                                                                          • String ID: Shell_TrayWnd
                                                                                          • API String ID: 3302017455-2988720461
                                                                                          • Opcode ID: 1a93c7d4de0b615177d9d13cbeba1691afb53fd65bd9b4abae244aa36ec232cf
                                                                                          • Instruction ID: 0f6327d15306e25675417dddecb6a7df4d25bf0024a7510c0524deb1e49c5f52
                                                                                          • Opcode Fuzzy Hash: 1a93c7d4de0b615177d9d13cbeba1691afb53fd65bd9b4abae244aa36ec232cf
                                                                                          • Instruction Fuzzy Hash: 42E0E531340354A7D3244B109D0AFEA7364EB98715F00C83AF602612C1E7F8650186A9
                                                                                          APIs
                                                                                          • HeapAlloc.KERNEL32(00000000,00002020,10006340,10006340,?,?,10003CBC,?,00000010,?,00000009,00000009,?,100022CC,00000010,?), ref: 10003811
                                                                                          • VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,10003CBC,?,00000010,?,00000009,00000009,?,100022CC,00000010,?), ref: 10003835
                                                                                          • VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,10003CBC,?,00000010,?,00000009,00000009,?,100022CC,00000010,?), ref: 1000384F
                                                                                          • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,10003CBC,?,00000010,?,00000009,00000009,?,100022CC,00000010,?,?), ref: 10003910
                                                                                          • HeapFree.KERNEL32(00000000,00000000,?,?,10003CBC,?,00000010,?,00000009,00000009,?,100022CC,00000010,?,?,?), ref: 10003927
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocVirtual$FreeHeap
                                                                                          • String ID:
                                                                                          • API String ID: 714016831-0
                                                                                          • Opcode ID: 3ff601db5208e3eab032ef99fe04253c1afb4941874838a1867b5b6f223e2f87
                                                                                          • Instruction ID: a795f6d920d86e332560b6b800bdc54746609468c7ebeb42c1671291bbad8c89
                                                                                          • Opcode Fuzzy Hash: 3ff601db5208e3eab032ef99fe04253c1afb4941874838a1867b5b6f223e2f87
                                                                                          • Instruction Fuzzy Hash: 5231E670A40716AFF332CF24CC84B27BBE9EB487D4F208539F55597298DB70A9448B84
                                                                                          APIs
                                                                                          • WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 0040CDD1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3934441357-0
                                                                                          • Opcode ID: 5abe86667080ec5df2176af5363076d4c30bc5bbadc6e5d2a0059fd9eea6e046
                                                                                          • Instruction ID: 9f296f8da53fdc3705c181212f390ada162afd572180a989542ef06ec7d0d9ab
                                                                                          • Opcode Fuzzy Hash: 5abe86667080ec5df2176af5363076d4c30bc5bbadc6e5d2a0059fd9eea6e046
                                                                                          • Instruction Fuzzy Hash: F2516B31900208EFCB11DF69C884A9E7BB5FF45340F2482BAE815AB2A1D7349A41DB99
                                                                                          APIs
                                                                                          • WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 021B2CC0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3934441357-0
                                                                                          • Opcode ID: 4d2490f154e423b146ba09fe86ae40186c924515e4f2be7e5e2d842eaf0193bb
                                                                                          • Instruction ID: 74659a00bb7520f98cbd3a329eadc72fce865440f702391c3e95708c62d7c2cc
                                                                                          • Opcode Fuzzy Hash: 4d2490f154e423b146ba09fe86ae40186c924515e4f2be7e5e2d842eaf0193bb
                                                                                          • Instruction Fuzzy Hash: 1B517B31A8024CEFCB13DF68C884AED7BB5FF45385F1085A6ED259B261D7309A95CB60
                                                                                          APIs
                                                                                            • Part of subcall function 00417C88: GetParent.USER32(?), ref: 00417CBB
                                                                                            • Part of subcall function 00417C88: GetLastActivePopup.USER32(?), ref: 00417CCA
                                                                                            • Part of subcall function 00417C88: IsWindowEnabled.USER32(?), ref: 00417CDF
                                                                                            • Part of subcall function 00417C88: EnableWindow.USER32(?,00000000), ref: 00417CF2
                                                                                          • SendMessageW.USER32(?,00000376,00000000,00000000), ref: 00417B46
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00417BB4
                                                                                          • MessageBoxW.USER32(00000000,?,?,00000000), ref: 00417BC2
                                                                                          • EnableWindow.USER32(00000000,00000001), ref: 00417BDE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
                                                                                          • String ID:
                                                                                          • API String ID: 1958756768-0
                                                                                          • Opcode ID: e4777a75535c1ffdb4df26dce9f36566f4cc0a46e4ca42a91d58d6a28cf27bd6
                                                                                          • Instruction ID: 94c10f18f54662e9d4039a46665a4390bc7a5a32921461de61726b8990409630
                                                                                          • Opcode Fuzzy Hash: e4777a75535c1ffdb4df26dce9f36566f4cc0a46e4ca42a91d58d6a28cf27bd6
                                                                                          • Instruction Fuzzy Hash: 0921A272A08208AFDB209F94CCC5BEFB7B5EB44358F24446AE510E7291D779ADC48B94
                                                                                          APIs
                                                                                          • lstrcpynW.KERNEL32(00416793,?,00000104,?,?,?,?,?,?,?,00416781,?), ref: 004167C1
                                                                                          • GetFileTime.KERNEL32(00000000,00416781,?,?,?,?,?,?,?,?,?,00416781,?), ref: 004167E2
                                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00416781,?), ref: 004167F1
                                                                                          • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00416781,?), ref: 00416812
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$AttributesSizeTimelstrcpyn
                                                                                          • String ID:
                                                                                          • API String ID: 1499663573-0
                                                                                          • Opcode ID: 2b103fa513f65db0c07b914aa3a3bcb43e9aebe5c2d3eb226dbc0bb73d61f90f
                                                                                          • Instruction ID: ae9d58d74063b1b60f6d7ff36a832fd5da7e2f77654d7629bc2e1e912f74e3bf
                                                                                          • Opcode Fuzzy Hash: 2b103fa513f65db0c07b914aa3a3bcb43e9aebe5c2d3eb226dbc0bb73d61f90f
                                                                                          • Instruction Fuzzy Hash: 78315072500605EFD710EF65C885EEBBBA8FF14314F10892EE256D7690E774E984CB94
                                                                                          APIs
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,00000000,?,00000000,?,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410AFA
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,0040AD63,?,00000000,00000000,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410B0D
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,0040AD63,?,?,00000000,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410B59
                                                                                          • CompareStringW.KERNEL32(00000000,00000000,00000000,?,?,00000000,?,00000000,?,0040ED24,0040AEF0,00000000,?,?,0040AD63,00000000), ref: 00410B71
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharMultiWide$CompareString
                                                                                          • String ID:
                                                                                          • API String ID: 376665442-0
                                                                                          • Opcode ID: b9e56a15e1697d0df59035eb56beb99b33db44030e739fc28fac3ad03d8d9149
                                                                                          • Instruction ID: 6ec3be255caf42c4f23c0da68d7f6a647adfe0c617b77d3d6bf91dfbcf0c44aa
                                                                                          • Opcode Fuzzy Hash: b9e56a15e1697d0df59035eb56beb99b33db44030e739fc28fac3ad03d8d9149
                                                                                          • Instruction Fuzzy Hash: EA210432900209EFCF218FD4CC459DEBFB5FB493A4F11412AFA11621A0C376ADA1DBA4
                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00415B28
                                                                                          • GetCurrentProcess.KERNEL32(?,00000000), ref: 00415B2E
                                                                                          • DuplicateHandle.KERNEL32(00000000), ref: 00415B31
                                                                                          • GetLastError.KERNEL32(00000000), ref: 00415B4B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentProcess$DuplicateErrorHandleLast
                                                                                          • String ID:
                                                                                          • API String ID: 3907606552-0
                                                                                          • Opcode ID: ccaf5aaaa1d3101faf2ee996468093f9ce8e743b664bf8a7ab6dff8ce63b648e
                                                                                          • Instruction ID: 14e080c525704b5305356be9bac10ac262583182be535820c327432f656c206b
                                                                                          • Opcode Fuzzy Hash: ccaf5aaaa1d3101faf2ee996468093f9ce8e743b664bf8a7ab6dff8ce63b648e
                                                                                          • Instruction Fuzzy Hash: D9018871744200BFEB10ABB6DC49FDA7B9DDF84750F144126B915CB291EB74EC408BA4
                                                                                          APIs
                                                                                          • GetDlgItem.USER32(?,?), ref: 00413A60
                                                                                          • GetTopWindow.USER32(00000000), ref: 00413A73
                                                                                          • GetTopWindow.USER32(?), ref: 00413AA3
                                                                                          • GetWindow.USER32(00000000,00000002), ref: 00413ABE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Item
                                                                                          • String ID:
                                                                                          • API String ID: 369458955-0
                                                                                          • Opcode ID: 525efac433b8934142c6397e0a568a4ca13440c6acf2e0d206c328baeb1d21eb
                                                                                          • Instruction ID: 1bf44d2e66cbfcdf14f56451fac5b60dee0b1d4578dd5c2f3ca0db131996e308
                                                                                          • Opcode Fuzzy Hash: 525efac433b8934142c6397e0a568a4ca13440c6acf2e0d206c328baeb1d21eb
                                                                                          • Instruction Fuzzy Hash: B301A232501619BBCB226FA58C00EDF3E99AF917E6F048026FD80D1210D739CAA197ED
                                                                                          APIs
                                                                                          • GetTopWindow.USER32(?), ref: 00413ADC
                                                                                          • SendMessageW.USER32(00000000,?,?,?), ref: 00413B12
                                                                                          • GetTopWindow.USER32(00000000), ref: 00413B1F
                                                                                          • GetWindow.USER32(00000000,00000002), ref: 00413B3D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$MessageSend
                                                                                          • String ID:
                                                                                          • API String ID: 1496643700-0
                                                                                          • Opcode ID: eb6df005899d0a2c6a177d21de6b89895112f5b33e828df30a8220470bf1b5fb
                                                                                          • Instruction ID: cf6082e4a7f2f3329f59f747cf5c051a22c34231f1153dcc4b4686929388aac0
                                                                                          • Opcode Fuzzy Hash: eb6df005899d0a2c6a177d21de6b89895112f5b33e828df30a8220470bf1b5fb
                                                                                          • Instruction Fuzzy Hash: 1D012932004119BBCF125F919D04EDF3B2AFF58352F048016FA1095122D73ADAB2EBE9
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Item$EnableFocusMenuNextParent
                                                                                          • String ID:
                                                                                          • API String ID: 988757621-0
                                                                                          • Opcode ID: 0be1a3ffe52330d5fc0e02383c3c33510ec942cf53632fd4c981f5d158b01640
                                                                                          • Instruction ID: 0f51dc4ebeed7b23c39ad6bf70470c30744aeaae8fecbe429ac15d7417414d91
                                                                                          • Opcode Fuzzy Hash: 0be1a3ffe52330d5fc0e02383c3c33510ec942cf53632fd4c981f5d158b01640
                                                                                          • Instruction Fuzzy Hash: 6F1182701046009BCB289F61DC49BAB77B5EF90325F108A5EF142836A0C778F885CB58
                                                                                          APIs
                                                                                          • RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 00417E31
                                                                                          • RegCloseKey.ADVAPI32(00000000,?,?), ref: 00417E3A
                                                                                          • wsprintfW.USER32 ref: 00417E56
                                                                                          • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00417E6F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClosePrivateProfileStringValueWritewsprintf
                                                                                          • String ID:
                                                                                          • API String ID: 1902064621-0
                                                                                          • Opcode ID: 6ead68bc10d2f94c7362e0913077e5f7337981e46048d236b344fae5ab052a91
                                                                                          • Instruction ID: a157e4f8b6bc9d0e3b0974c8d3bb55176af0ee830b5b890abb55ea4fdbea6782
                                                                                          • Opcode Fuzzy Hash: 6ead68bc10d2f94c7362e0913077e5f7337981e46048d236b344fae5ab052a91
                                                                                          • Instruction Fuzzy Hash: CB014B32400628BBCB125FA4DC09FEF3BB9EF08754F048026FA15A61A0E774D9648BD8
                                                                                          APIs
                                                                                          • GetObjectW.GDI32(00000000,0000000C,?), ref: 004140DD
                                                                                          • SetBkColor.GDI32(00000000,00000000), ref: 004140E9
                                                                                          • GetSysColor.USER32(00000008), ref: 004140F9
                                                                                          • SetTextColor.GDI32(00000000,?), ref: 00414103
                                                                                            • Part of subcall function 0041722D: GetWindowLongW.USER32(00000000,000000F0), ref: 0041723E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Color$LongObjectTextWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2871169696-0
                                                                                          • Opcode ID: b37fdcbec5af700c955940ec9cdf9ac4fa6dedeacaa93bfe52c1102225e0491f
                                                                                          • Instruction ID: 494a3a31d50cb3adc00303d62ca39082c40d7e89d0b05fa09f90d403c3c2a2fe
                                                                                          • Opcode Fuzzy Hash: b37fdcbec5af700c955940ec9cdf9ac4fa6dedeacaa93bfe52c1102225e0491f
                                                                                          • Instruction Fuzzy Hash: BB012430100219BBDF215F65EC49AEF3B69EB54320F108523FA12D62B0CB78C9D5CAA9
                                                                                          APIs
                                                                                          • lstrlenW.KERNEL32(?), ref: 004172F9
                                                                                          • GetWindowTextW.USER32(?,?,00000100), ref: 00417315
                                                                                          • lstrcmpW.KERNEL32(?,?), ref: 00417329
                                                                                          • SetWindowTextW.USER32(?,?), ref: 00417339
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: TextWindow$lstrcmplstrlen
                                                                                          • String ID:
                                                                                          • API String ID: 330964273-0
                                                                                          • Opcode ID: 759c3d798eb437b4dcf08f51014f75214014c906220f238e6bbad2c833e49e7f
                                                                                          • Instruction ID: 20e04a164428aa14030cfbe7c3b025316c463aa3b199b033c8b869d3cbacf3cb
                                                                                          • Opcode Fuzzy Hash: 759c3d798eb437b4dcf08f51014f75214014c906220f238e6bbad2c833e49e7f
                                                                                          • Instruction Fuzzy Hash: 84F0D43140011DABDF216F24ED48ADA7B79FB18390F048061FC65D2260D7358A94DBD8
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Info
                                                                                          • String ID: $
                                                                                          • API String ID: 1807457897-3032137957
                                                                                          • Opcode ID: d62c4e526d14f83023dca8de11a5968097f7da0f90f1e7a247e4e89d9651d0c8
                                                                                          • Instruction ID: ca72819a4169c696aed226029d5811a8d811588d48259f150f4c5abbff6fb703
                                                                                          • Opcode Fuzzy Hash: d62c4e526d14f83023dca8de11a5968097f7da0f90f1e7a247e4e89d9651d0c8
                                                                                          • Instruction Fuzzy Hash: 7E4157310052A85AFB16DB24CD89BEA7FA9FB157C0F1001F6D5C5DB09ACA714F48CBA2
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Info
                                                                                          • String ID: $
                                                                                          • API String ID: 1807457897-3032137957
                                                                                          • Opcode ID: 401584b19cd5ce3328f094dc8923b45f4f811b8efa4b6413a02e0972f14e31ac
                                                                                          • Instruction ID: 006d588d60314e97c046a91129e19a7b5833a2406829f10d4c3c689a1209877e
                                                                                          • Opcode Fuzzy Hash: 401584b19cd5ce3328f094dc8923b45f4f811b8efa4b6413a02e0972f14e31ac
                                                                                          • Instruction Fuzzy Hash: 49415B315042585EEF228724DD5ABF77FA9DB07704F1404E6E289CB192C2F949C9CBAB
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: Info
                                                                                          • String ID: $
                                                                                          • API String ID: 1807457897-3032137957
                                                                                          • Opcode ID: a41fe2902770a50c6c83c30bb56ddc2f956dd98cf6fc26b4df0b32148f045840
                                                                                          • Instruction ID: 0947841485e00e1c5083eec6ac80401f646c37a46477fd8c815edb143ca3d44a
                                                                                          • Opcode Fuzzy Hash: a41fe2902770a50c6c83c30bb56ddc2f956dd98cf6fc26b4df0b32148f045840
                                                                                          • Instruction Fuzzy Hash: AD4147315842985EEF178624DC59BE77FFDAF01B04F1606E4E166CA182C37186A8CBA2
                                                                                          APIs
                                                                                            • Part of subcall function 0041967A: LeaveCriticalSection.KERNEL32(?,00419242,00000010,00000010,?,00000000,?,?,?,004189F6,Vht ,00418139,004189FC,004154AA,00416C26), ref: 00419692
                                                                                            • Part of subcall function 0040A1D7: RaiseException.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0040979D,00000000), ref: 0040A205
                                                                                          • wsprintfW.USER32 ref: 00413094
                                                                                          • wsprintfW.USER32 ref: 004130B0
                                                                                          • GetClassInfoW.USER32(?,-00000058,?), ref: 004130BF
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: wsprintf$ClassCriticalExceptionInfoLeaveRaiseSection
                                                                                          • String ID: Afx:%x:%x
                                                                                          • API String ID: 2529146597-2071556601
                                                                                          • Opcode ID: 28c21c23f11714b2316a3b4b7d5cbadabd5eb9982b460deff8cf463eda10cde8
                                                                                          • Instruction ID: 63b91ad6e5d8b3a83d3964ca0b0158b98141b3fdf6e4971ae2370bc0e36da690
                                                                                          • Opcode Fuzzy Hash: 28c21c23f11714b2316a3b4b7d5cbadabd5eb9982b460deff8cf463eda10cde8
                                                                                          • Instruction Fuzzy Hash: E4112171900219AFCB10DFA5D9819EFBBF8EF48355F00402FF918E3201D7789A958BA9
                                                                                          APIs
                                                                                          • PostMessageW.USER32(?,0000052E,00000001,00000001), ref: 00401696
                                                                                          • CallNextHookEx.USER32(?,?,?,?), ref: 004016AD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CallHookMessageNextPost
                                                                                          • String ID: %x
                                                                                          • API String ID: 1949595931-3337897977
                                                                                          • Opcode ID: b091b6e87d18cf9c5efa81e666ca78e0c4bc82c14139698c37d4b79dcebd343e
                                                                                          • Instruction ID: b6ad863b5d2363be68a04fdde2fb45dfce1eaa4e8f2f28e44550792861b0d6d3
                                                                                          • Opcode Fuzzy Hash: b091b6e87d18cf9c5efa81e666ca78e0c4bc82c14139698c37d4b79dcebd343e
                                                                                          • Instruction Fuzzy Hash: F7F089B9600200ABD234DB18EC86FE777A9EFD9B10F154C2DFA54A3290D2B59950C776
                                                                                          APIs
                                                                                          • KillTimer.USER32(?,000000C8), ref: 0040228E
                                                                                          • OutputDebugStringW.KERNEL32(Stop....), ref: 00402299
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: DebugKillOutputStringTimer
                                                                                          • String ID: Stop....
                                                                                          • API String ID: 3598302801-336397578
                                                                                          • Opcode ID: ea396ed567de6a2397fb89dc371f953381b00dadcee3f1cda6747af6f6d8fcfb
                                                                                          • Instruction ID: f385e9af8f817c04d9d1f9444d344769521b6fca20657c6e46a2efac944be961
                                                                                          • Opcode Fuzzy Hash: ea396ed567de6a2397fb89dc371f953381b00dadcee3f1cda6747af6f6d8fcfb
                                                                                          • Instruction Fuzzy Hash: 5DD05E76A40700CBD3619FD4E909B8577A4F798701F40867BE102826D0C7BC50098FA9
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(?), ref: 004190E0
                                                                                          • LeaveCriticalSection.KERNEL32(?,?), ref: 004190F0
                                                                                          • LocalFree.KERNEL32(?), ref: 004190F9
                                                                                          • TlsSetValue.KERNEL32(?,00000000), ref: 0041910F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$EnterFreeLeaveLocalValue
                                                                                          • String ID:
                                                                                          • API String ID: 2949335588-0
                                                                                          • Opcode ID: a5a36bfe568c76610cf6366b033eec349fcd53a29d1b2235826f9c98be5310a4
                                                                                          • Instruction ID: c294862dd943ef3e6fe187101cf85265e796c57589b37854cfce1349e042ab1c
                                                                                          • Opcode Fuzzy Hash: a5a36bfe568c76610cf6366b033eec349fcd53a29d1b2235826f9c98be5310a4
                                                                                          • Instruction Fuzzy Hash: 9A219D31200204EFDB20CF55D894BAA7BB4FF48715F04806EE5168B2A1C7B5EC81CB99
                                                                                          APIs
                                                                                          • HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,1000340C,?,?,?,1000226E,?,?,?,?,?,?), ref: 1000366C
                                                                                          • HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,1000340C,?,?,?,1000226E,?,?,?,?,?,?), ref: 100036A0
                                                                                          • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 100036BA
                                                                                          • HeapFree.KERNEL32(00000000,?), ref: 100036D1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeap$FreeVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 3499195154-0
                                                                                          • Opcode ID: c1363864bc79b40bf93b5b121fa689c302ce476f1bd6739eb23b09e4330a4cac
                                                                                          • Instruction ID: a2005d475687f7966687cd62e1aba63e0b7c4ead1fc2fa0626cea57b63571ae9
                                                                                          • Opcode Fuzzy Hash: c1363864bc79b40bf93b5b121fa689c302ce476f1bd6739eb23b09e4330a4cac
                                                                                          • Instruction Fuzzy Hash: 6A115B30200221AFE7218F28CC85D267BB6FB957E07208A2AE291C65F8C3329941DB00
                                                                                          APIs
                                                                                          • InitializeCriticalSection.KERNEL32(?,100012DD,?,10001067), ref: 10001EBE
                                                                                          • InitializeCriticalSection.KERNEL32 ref: 10001EC6
                                                                                          • InitializeCriticalSection.KERNEL32 ref: 10001ECE
                                                                                          • InitializeCriticalSection.KERNEL32 ref: 10001ED6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2952489380.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2952448892.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952543787.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952603349.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952658094.0000000010008000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2952705238.000000001000A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_10000000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalInitializeSection
                                                                                          • String ID:
                                                                                          • API String ID: 32694325-0
                                                                                          • Opcode ID: 51832af506bc11810d82875efca259352d23e4a39a14192025db6ee435b0a2d7
                                                                                          • Instruction ID: 80b25f43c9e5ee801a92e39f911b81a5483c894a1e940c0d7549a411f7c845e7
                                                                                          • Opcode Fuzzy Hash: 51832af506bc11810d82875efca259352d23e4a39a14192025db6ee435b0a2d7
                                                                                          • Instruction Fuzzy Hash: 58C00231805039DAFA112B65ED8688B3FA7EB0D3E13150072E50451139C6221C20DFD0
                                                                                          APIs
                                                                                          • InitializeCriticalSection.KERNEL32(?,0040BA22,?,0040972E), ref: 0040D757
                                                                                          • InitializeCriticalSection.KERNEL32(?,0040BA22,?,0040972E), ref: 0040D75F
                                                                                          • InitializeCriticalSection.KERNEL32(?,0040BA22,?,0040972E), ref: 0040D767
                                                                                          • InitializeCriticalSection.KERNEL32(?,0040BA22,?,0040972E), ref: 0040D76F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2949216060.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2949149222.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949318010.000000000041B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000421000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949397676.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000449000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048A000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000048D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.000000000049B000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2949530236.00000000004A5000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalInitializeSection
                                                                                          • String ID:
                                                                                          • API String ID: 32694325-0
                                                                                          • Opcode ID: 71a647a46ba15a7fde0358bc4ede280d549a20fd0f30447b858c523ec34eb307
                                                                                          • Instruction ID: 5a2f13c158f2626708b82955307cf22c674e69c0a1ecb30266df5b33785dcc9f
                                                                                          • Opcode Fuzzy Hash: 71a647a46ba15a7fde0358bc4ede280d549a20fd0f30447b858c523ec34eb307
                                                                                          • Instruction Fuzzy Hash: 21C00231A04034FBCA393B65FF158853F65FB442A13854173A5045207087A25C52EFD8
                                                                                          APIs
                                                                                          • InitializeCriticalSection.KERNEL32(?,021B20B1,?,021B1519), ref: 021B3192
                                                                                          • InitializeCriticalSection.KERNEL32 ref: 021B319A
                                                                                          • InitializeCriticalSection.KERNEL32 ref: 021B31A2
                                                                                          • InitializeCriticalSection.KERNEL32 ref: 021B31AA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.2950780325.00000000021B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 021B0000, based on PE: true
                                                                                          • Associated: 00000003.00000002.2950719083.00000000021B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950841962.00000000021B6000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2950969861.00000000021B7000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.2951020199.00000000021BB000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_21b0000_Monitor.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalInitializeSection
                                                                                          • String ID:
                                                                                          • API String ID: 32694325-0
                                                                                          • Opcode ID: 14aca3ca390777ae621be447db563a3af694b136e7deb19511633196c058fdd1
                                                                                          • Instruction ID: 872cd25d239a0c4368bbb0a912a4a67423bf2a0a2395c3ac7468b899eac3b510
                                                                                          • Opcode Fuzzy Hash: 14aca3ca390777ae621be447db563a3af694b136e7deb19511633196c058fdd1
                                                                                          • Instruction Fuzzy Hash: 7BC0E933C940249ADA536B6AFD09887BEB5EB9536130108A2A104520B086211CB2DFD0

                                                                                          Execution Graph

                                                                                          Execution Coverage:4.9%
                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                          Signature Coverage:1.5%
                                                                                          Total number of Nodes:2000
                                                                                          Total number of Limit Nodes:47
                                                                                          execution_graph 67369 409c60 67412 44ac6b 67369->67412 67371 409c70 67372 409cc2 SendMessageW SendMessageW 67371->67372 67373 409ced 67372->67373 67431 44db1e 67373->67431 67375 409d0a 67376 409d14 OpenMutexW 67375->67376 67434 4256c0 65 API calls ctype 67376->67434 67378 409d33 67379 409d61 67378->67379 67380 409d3f 67378->67380 67381 44e6af 28 API calls 67379->67381 67528 448c87 67380->67528 67383 409d5f 67381->67383 67435 44e6af 67383->67435 67389 409d94 67390 409db8 67389->67390 67391 409d9d 67389->67391 67534 40e790 WaitForSingleObject ReleaseMutex 67390->67534 67532 424450 124 API calls ctype 67391->67532 67394 409da2 67397 409db3 67394->67397 67533 4230e0 67 API calls 67394->67533 67451 409240 105 API calls ctype 67397->67451 67398 409dda 67535 4263c0 105 API calls ctype 67398->67535 67400 409de5 67452 4096d0 76 API calls 67400->67452 67402 409dfb 67453 409070 67402->67453 67405 409e31 67407 409e3b LoadStringW 67405->67407 67536 44e688 26 API calls ctype 67407->67536 67409 409e78 LoadStringW 67537 44e688 26 API calls ctype 67409->67537 67411 409e9f 67413 44ac75 67412->67413 67414 44ac7d 67412->67414 67547 44d365 67413->67547 67538 44d315 67414->67538 67417 44ac7b 67418 44ac98 67417->67418 67556 44d0a4 21 API calls __EH_prolog 67417->67556 67557 44ab45 EndDialog 67418->67557 67421 44ac94 67421->67418 67423 44aca5 67421->67423 67422 44aca1 67422->67371 67558 44da5c 50 API calls 67423->67558 67425 44acb1 67426 44acb7 67425->67426 67427 44accb 67425->67427 67559 44ac15 28 API calls ctype 67426->67559 67427->67371 67429 44acbc 67560 44dc1f ShowWindow 67429->67560 67432 44db34 67431->67432 67433 44db25 SetWindowTextW 67431->67433 67432->67375 67433->67432 67434->67378 67436 44e6c7 67435->67436 67437 44e6bc lstrlenA 67435->67437 69459 44e4c8 67436->69459 67437->67436 67440 44e983 MultiByteToWideChar 67441 44e6db 67440->67441 67442 44e8fd 26 API calls 67441->67442 67443 409d82 67442->67443 67444 40e700 OpenFileMappingW 67443->67444 67445 40e71c 67444->67445 67446 40e71e MapViewOfFile 67444->67446 67445->67389 67447 40e734 67446->67447 67448 40e746 67446->67448 69466 44c8ae 29 API calls ctype 67447->69466 67448->67389 67450 40e742 67450->67389 67451->67398 67452->67402 67454 4259c0 61 API calls 67453->67454 67455 4090b2 67454->67455 67456 44e638 26 API calls 67455->67456 67457 4090c4 67456->67457 67458 44e4f1 ctype 23 API calls 67457->67458 67459 4090d2 67458->67459 67460 44e5ba 28 API calls 67459->67460 67461 4090e0 67460->67461 67462 44e730 28 API calls 67461->67462 67463 4090fa 67462->67463 67464 44e638 26 API calls 67463->67464 67465 409109 67464->67465 67466 44e4f1 ctype 23 API calls 67465->67466 67467 409116 67466->67467 67468 44e4f1 ctype 23 API calls 67467->67468 67469 409124 DeleteFileW 67468->67469 67470 44e25e 27 API calls 67469->67470 67471 409140 67470->67471 67472 419b60 27 API calls 67471->67472 67473 409149 67472->67473 67474 44e5ba 28 API calls 67473->67474 67475 409168 67474->67475 67476 44e5ba 28 API calls 67475->67476 67477 40917e 67476->67477 69467 419e00 wsprintfW WritePrivateProfileStringW 67477->69467 67479 4091ef 67480 44e4f1 ctype 23 API calls 67479->67480 67481 4091fd 67480->67481 67483 44e4f1 ctype 23 API calls 67481->67483 67482 448c87 66 API calls 67484 40918b 67482->67484 67485 40920b 67483->67485 67484->67479 67484->67482 67486 44e25e 27 API calls 67484->67486 67489 44e5ba 28 API calls 67484->67489 69472 419d20 24 API calls ctype 67484->69472 67487 44e4f1 ctype 23 API calls 67485->67487 67486->67484 67488 409219 67487->67488 67490 44e4f1 ctype 23 API calls 67488->67490 67489->67484 67492 40922a 67490->67492 67492->67405 67493 424700 67492->67493 67494 42471b 67493->67494 69473 422fc0 RegOpenKeyExW 67494->69473 67497 424739 67497->67405 67499 424759 69477 439d30 WideCharToMultiByte 67499->69477 67503 424784 67504 439d30 7 API calls 67503->67504 67505 42478e 67504->67505 69481 423000 RegQueryValueExW 67505->69481 67507 4247a8 67508 439d30 7 API calls 67507->67508 67509 4247b2 67508->67509 69482 423000 RegQueryValueExW 67509->69482 67511 4247c8 67512 439d30 7 API calls 67511->67512 67513 4247d2 67512->67513 69483 423000 RegQueryValueExW 67513->69483 67515 4247eb 67516 439d30 7 API calls 67515->67516 67517 4247f5 RegCloseKey 67516->67517 67519 422fc0 2 API calls 67517->67519 67520 424862 67519->67520 67521 424869 67520->67521 69484 423000 RegQueryValueExW 67520->69484 67521->67405 67523 42488a 67524 439d30 7 API calls 67523->67524 67525 424894 67524->67525 67526 4248bf RegCloseKey 67525->67526 67527 42489c RegCloseKey 67525->67527 67526->67405 67527->67405 69493 44898c 67528->69493 67531 4486fb 26 API calls ctype 67531->67383 67532->67394 67533->67397 67534->67397 67535->67400 67536->67409 67537->67411 67539 44d357 67538->67539 67540 44d322 67538->67540 67541 44d365 292 API calls 67539->67541 67561 453485 67540->67561 67543 44d34a 67541->67543 67543->67417 67545 44d33e LoadResource 67545->67543 67546 44d34e LockResource 67545->67546 67546->67539 67548 44d45d 67547->67548 67554 44d387 67547->67554 67550 44d473 67548->67550 67607 44c959 GetTopWindow 67548->67607 67550->67417 67551 44d3dd lstrlenA 67551->67554 67552 44d436 SendDlgItemMessageA 67552->67554 67553 44d410 SendDlgItemMessageW 67553->67554 67554->67548 67554->67551 67554->67552 67554->67553 67555 44d3f4 MultiByteToWideChar 67554->67555 67555->67553 67556->67421 67557->67422 67558->67425 67559->67429 67560->67427 67566 453fe7 67561->67566 67564 44d327 FindResourceW 67564->67539 67564->67545 67567 45401d TlsGetValue 67566->67567 67569 453ff0 67566->67569 67568 454030 67567->67568 67574 453494 67568->67574 67575 454043 67568->67575 67570 45400a 67569->67570 67593 453be7 RaiseException TlsAlloc InitializeCriticalSection ctype 67569->67593 67583 453c80 EnterCriticalSection 67570->67583 67573 45401b 67573->67567 67574->67564 67577 45407c 67574->67577 67594 453def 8 API calls ctype 67575->67594 67579 454086 __EH_prolog 67577->67579 67578 4540b4 67578->67564 67579->67578 67596 4543b1 67579->67596 67588 453c9f 67583->67588 67584 453d70 LeaveCriticalSection 67584->67573 67585 453d5b ctype 67585->67584 67586 453cec GlobalHandle GlobalUnlock GlobalReAlloc 67589 453d0e 67586->67589 67587 453cd9 GlobalAlloc 67587->67589 67588->67585 67588->67586 67588->67587 67590 453d37 GlobalLock 67589->67590 67591 453d1c GlobalHandle GlobalLock LeaveCriticalSection 67589->67591 67590->67585 67595 449405 RaiseException ctype 67591->67595 67593->67570 67594->67574 67597 4543c1 67596->67597 67598 4543bc 67596->67598 67600 45409d 67597->67600 67601 4543e5 EnterCriticalSection 67597->67601 67602 45440e EnterCriticalSection 67597->67602 67606 45431e GetVersion InitializeCriticalSection 67598->67606 67605 454421 LeaveCriticalSection 67600->67605 67603 454406 LeaveCriticalSection 67601->67603 67604 4543f3 InitializeCriticalSection 67601->67604 67602->67600 67603->67602 67604->67603 67605->67578 67606->67597 67608 44c969 67607->67608 67609 44c9d0 67608->67609 67610 44c993 SendMessageW 67608->67610 67612 44c9c5 GetWindow 67608->67612 67613 44c9a9 GetTopWindow 67608->67613 67614 44c959 284 API calls 67608->67614 67616 44b328 67608->67616 67619 44b140 67608->67619 67609->67550 67610->67608 67612->67608 67613->67608 67613->67612 67614->67612 67630 44b28f 67616->67630 67618 44b32f ctype 67618->67608 67620 44b14a __EH_prolog 67619->67620 67621 453fe7 ctype 21 API calls 67620->67621 67622 44b162 67621->67622 67623 44b1bf 67622->67623 67723 44afcd GetWindowRect GetWindowLongW 67622->67723 67689 402950 67623->67689 67695 44c098 67623->67695 67625 44b1d0 67626 44b1e8 67625->67626 67710 44aff0 67625->67710 67626->67608 67631 44b299 __EH_prolog 67630->67631 67638 4534ab 67631->67638 67633 44b29f ctype 67636 44b2dd ctype 67633->67636 67643 44e22a 67633->67643 67636->67618 67639 453485 ctype 28 API calls 67638->67639 67640 4534b0 67639->67640 67641 453fe7 ctype 21 API calls 67640->67641 67642 4534c1 67641->67642 67642->67633 67645 44e230 67643->67645 67646 44b2c1 67645->67646 67648 439efc 67645->67648 67646->67636 67647 4502a3 20 API calls 2 library calls 67646->67647 67647->67636 67651 439f0e 67648->67651 67652 439f0b 67651->67652 67654 439f15 ctype 67651->67654 67652->67645 67654->67652 67655 439f3a 67654->67655 67656 439f48 67655->67656 67664 439f5e 67655->67664 67665 43d7a4 67656->67665 67658 439f70 RtlAllocateHeap 67660 439f65 67658->67660 67659 439f4f 67680 43f244 67659->67680 67660->67654 67664->67658 67664->67660 67666 43d7fa EnterCriticalSection 67665->67666 67667 43d7bc 67665->67667 67666->67659 67668 439efc ctype 18 API calls 67667->67668 67669 43d7c4 67668->67669 67670 43d7d2 67669->67670 67671 4391a3 ctype 7 API calls 67669->67671 67672 43d7a4 ctype 18 API calls 67670->67672 67671->67670 67673 43d7da 67672->67673 67674 43d7e1 InitializeCriticalSection 67673->67674 67675 43d7eb 67673->67675 67676 43d7f0 67674->67676 67677 439f88 ctype 18 API calls 67675->67677 67678 43d805 ctype LeaveCriticalSection 67676->67678 67677->67676 67679 43d7f8 67678->67679 67679->67666 67684 43f276 67680->67684 67681 43f31e 67682 43f5fe ctype VirtualAlloc 67681->67682 67683 43f324 67682->67683 67687 439f55 67683->67687 67684->67681 67685 43f54d ctype HeapReAlloc HeapAlloc VirtualAlloc HeapFree 67684->67685 67684->67687 67686 43f315 67685->67686 67686->67681 67686->67687 67688 43d805 LeaveCriticalSection 67687->67688 67688->67664 67690 402982 67689->67690 67691 402965 67689->67691 67724 44bb2b 67690->67724 67691->67690 67693 40296f SendMessageW 67691->67693 67693->67690 67729 4080c0 67695->67729 67747 44b268 67695->67747 67752 40a920 67695->67752 67768 422100 67695->67768 67802 44c0dc 67695->67802 67867 40b230 67695->67867 68844 419bd0 67695->68844 68855 408270 67695->68855 68865 419a70 9 API calls 67695->68865 68871 419eb0 GetPrivateProfileIntW 67695->68871 68876 403c60 GetParent 67695->68876 67696 44c0ba 67697 44c0d1 67696->67697 67709 44bb2b 2 API calls 67696->67709 67697->67625 67709->67697 67711 44b064 67710->67711 67712 44affd 67710->67712 67711->67626 67713 44dab9 GetWindowLongW 67712->67713 67714 44b007 67713->67714 67714->67711 67715 44b00e GetWindowRect 67714->67715 67715->67711 67716 44b025 67715->67716 67716->67711 67717 44b02d GetWindow 67716->67717 67718 44b301 49 API calls 67717->67718 67719 44b03e 67718->67719 67721 44b049 67719->67721 69449 44dc46 IsWindowEnabled 67719->69449 67721->67711 69419 44d15c 67721->69419 67723->67623 67725 44bb38 67724->67725 67726 44bb5a CallWindowProcW 67724->67726 67725->67726 67728 44bb46 DefWindowProcW 67725->67728 67727 402990 67726->67727 67727->67625 67728->67727 68881 45140f 67729->68881 67733 40810a CreateCompatibleDC 68890 450c58 67733->68890 67738 408185 67739 450d99 49 API calls 67738->67739 67740 408193 67739->67740 68899 450cc0 49 API calls ctype 67740->68899 67742 40819c 68900 450cd6 49 API calls 2 library calls 67742->68900 67744 4081ad 68901 451481 50 API calls 2 library calls 67744->68901 67746 4081c1 67746->67696 67748 453fe7 ctype 21 API calls 67747->67748 67749 44b27a 67748->67749 67751 44bb2b 2 API calls 67749->67751 67750 44b28d 67750->67696 67751->67750 67753 44b268 23 API calls 67752->67753 67755 40a92e 67753->67755 67754 40a933 67754->67696 67755->67754 68935 44daed 67755->68935 67758 40a991 67759 40a9f4 LoadLibraryW 67758->67759 68939 4257c0 67759->68939 67761 40aa0c 67762 40b230 166 API calls 67761->67762 67763 40aa2a 67762->67763 68964 419470 67763->68964 67765 40aa41 67766 40aa5b 67765->67766 67767 40aa4e SetWindowRgn 67765->67767 67766->67696 67767->67766 67769 45140f 50 API calls 67768->67769 67770 42212b 67769->67770 69074 44c829 52 API calls 67770->69074 67772 422165 GetClientRect CreateCompatibleDC 67773 450c58 48 API calls 67772->67773 67774 422190 67773->67774 67775 450d99 49 API calls 67774->67775 67776 4221a9 CreateCompatibleDC 67775->67776 67777 450c58 48 API calls 67776->67777 67778 4221c6 CreateCompatibleBitmap 67777->67778 69075 45154f 67778->69075 67781 450d99 49 API calls 67782 422210 BitBlt BitBlt 67781->67782 67783 42226c 67782->67783 67784 450d99 49 API calls 67783->67784 67785 42227a 67784->67785 69081 450cc0 49 API calls ctype 67785->69081 67787 422283 67788 450d99 49 API calls 67787->67788 67789 422295 67788->67789 69082 450cc0 49 API calls ctype 67789->69082 67791 42229e 69083 4515a6 67791->69083 67793 4222a7 67794 4515a6 49 API calls 67793->67794 67795 4222c0 67794->67795 69088 450cd6 49 API calls 2 library calls 67795->69088 67797 4222d1 69089 450cd6 49 API calls 2 library calls 67797->69089 67799 4222e2 69090 451481 50 API calls 2 library calls 67799->69090 67801 4222f6 67801->67696 67803 44c0e6 __EH_prolog 67802->67803 67804 44c15a 67803->67804 67854 44c0fd 67803->67854 69093 44b301 67803->69093 67806 44c177 67804->67806 67807 44c15f 67804->67807 67812 4543b1 ctype 6 API calls 67806->67812 69115 44b0ca 57 API calls 67807->69115 67811 44c16f 67811->67806 67811->67854 67813 44c198 67812->67813 67814 44c1dd 67813->67814 67816 44c1b6 67813->67816 67815 44c25a 67814->67815 67820 44c278 67814->67820 67839 44c53b 67814->67839 69117 454421 LeaveCriticalSection 67815->69117 69116 454421 LeaveCriticalSection 67816->69116 67819 44c1c3 67821 44c294 GetVersion 67819->67821 67822 44c2a6 67819->67822 67819->67854 67855 44c1d8 67819->67855 69118 454421 LeaveCriticalSection 67820->69118 67821->67822 67824 44c442 67822->67824 67825 44c44c 67822->67825 67826 44c2cd 67822->67826 67827 44c48d 67822->67827 67828 44c3c9 67822->67828 67829 44c416 67822->67829 67830 44c49b 67822->67830 67831 44c4a4 67822->67831 67832 44c2e4 67822->67832 67833 44c460 67822->67833 67834 44c3a0 67822->67834 67835 44c46d 67822->67835 67836 44c434 67822->67836 67837 44c2b7 67822->67837 67838 44c4b3 67822->67838 67822->67839 67822->67854 67822->67855 67860 44c2f2 67822->67860 67861 44c35f 67822->67861 69127 44ea2a 48 API calls 67824->69127 69128 44ea2a 48 API calls 67825->69128 67847 44b301 49 API calls 67826->67847 67850 44b301 49 API calls 67827->67850 69126 44ea2a 48 API calls 67828->69126 67842 44b301 49 API calls 67829->67842 67851 44b301 49 API calls 67830->67851 67852 44b301 49 API calls 67831->67852 67849 44b301 49 API calls 67832->67849 67856 44b301 49 API calls 67833->67856 67840 44b301 49 API calls 67834->67840 67857 44b301 49 API calls 67835->67857 67844 450c43 48 API calls 67836->67844 69119 450c43 67837->69119 67838->67854 67858 44b301 49 API calls 67838->67858 69129 454421 LeaveCriticalSection 67839->69129 67840->67854 67853 44c41e 67842->67853 67844->67854 67847->67854 67849->67855 67850->67854 67851->67854 67852->67854 67859 44b301 49 API calls 67853->67859 67854->67696 69109 449869 67855->69109 67856->67854 67857->67854 67858->67854 67859->67854 67862 44b328 48 API calls 67860->67862 69125 450cd6 49 API calls 2 library calls 67861->69125 67864 44c31e ctype 67862->67864 69124 44b921 49 API calls 2 library calls 67864->69124 67868 44e565 58 API calls 67867->67868 67869 40b295 67868->67869 67870 44e565 58 API calls 67869->67870 67871 40b2ab 67870->67871 69146 44e796 67871->69146 67874 419b60 27 API calls 67875 40b2d3 67874->67875 67876 44e565 58 API calls 67875->67876 67877 40b2ec 67876->67877 67878 44e565 58 API calls 67877->67878 67879 40b305 67878->67879 67880 44e565 58 API calls 67879->67880 67881 40b31e 67880->67881 67882 419bd0 60 API calls 67881->67882 67883 40b337 67882->67883 67884 44e565 58 API calls 67883->67884 67885 40b350 67884->67885 67886 44e565 58 API calls 67885->67886 67887 40b369 67886->67887 67888 44e565 58 API calls 67887->67888 67889 40b382 67888->67889 67890 419bd0 60 API calls 67889->67890 67891 40b398 67890->67891 67892 44e565 58 API calls 67891->67892 67893 40b3b1 67892->67893 67894 44e565 58 API calls 67893->67894 67895 40b3ca 67894->67895 67896 44e565 58 API calls 67895->67896 67897 40b3e3 67896->67897 67898 419bd0 60 API calls 67897->67898 67899 40b3f9 67898->67899 67900 44e565 58 API calls 67899->67900 67901 40b412 67900->67901 67902 44e565 58 API calls 67901->67902 67903 40b42b 67902->67903 67904 44e565 58 API calls 67903->67904 67905 40b444 67904->67905 67906 419bd0 60 API calls 67905->67906 67907 40b45a 67906->67907 67908 44e565 58 API calls 67907->67908 67909 40b473 67908->67909 67910 44e565 58 API calls 67909->67910 67911 40b48c 67910->67911 67912 44e565 58 API calls 67911->67912 67913 40b4a5 67912->67913 67914 419bd0 60 API calls 67913->67914 67915 40b4be 67914->67915 67916 44e730 28 API calls 67915->67916 67917 40b4da 67916->67917 67918 419a70 59 API calls 67917->67918 67919 40b4f4 67918->67919 67920 44e4f1 ctype 23 API calls 67919->67920 67921 40b508 67920->67921 67922 44e730 28 API calls 67921->67922 67923 40b51c 67922->67923 67924 419a70 59 API calls 67923->67924 67925 40b537 67924->67925 67926 44e4f1 ctype 23 API calls 67925->67926 67927 40b54b 67926->67927 67928 44e730 28 API calls 67927->67928 67929 40b55f 67928->67929 67930 419a70 59 API calls 67929->67930 67931 40b57a 67930->67931 67932 44e4f1 ctype 23 API calls 67931->67932 67933 40b58e 67932->67933 67934 44e730 28 API calls 67933->67934 67935 40b5a2 67934->67935 67936 419a70 59 API calls 67935->67936 67937 40b5bd 67936->67937 67938 44e4f1 ctype 23 API calls 67937->67938 67939 40b5d1 67938->67939 67940 44e730 28 API calls 67939->67940 67941 40b5e5 67940->67941 67942 419a70 59 API calls 67941->67942 67943 40b600 67942->67943 67944 44e4f1 ctype 23 API calls 67943->67944 67945 40b614 67944->67945 67946 44e730 28 API calls 67945->67946 67947 40b628 67946->67947 67948 419a70 59 API calls 67947->67948 67949 40b642 67948->67949 67950 44e4f1 ctype 23 API calls 67949->67950 67951 40b656 67950->67951 69156 44db8f 67951->69156 67954 44e565 58 API calls 67955 40b68f 67954->67955 67956 44e565 58 API calls 67955->67956 67957 40b6a8 67956->67957 67958 44e565 58 API calls 67957->67958 67959 40b6c1 67958->67959 67960 419bd0 60 API calls 67959->67960 67961 40b6d6 67960->67961 67962 44e638 26 API calls 67961->67962 67963 40b6e8 67962->67963 67964 44e4f1 ctype 23 API calls 67963->67964 67965 40b6f8 67964->67965 67966 44e25e 27 API calls 67965->67966 67967 40b70e 67966->67967 69159 422e20 67967->69159 67973 40b77f 69210 4039e0 67973->69210 67976 44e565 58 API calls 67977 40b79f 67976->67977 69213 403940 67977->69213 67980 44e4f1 ctype 23 API calls 67981 40b7c1 67980->67981 67982 44e565 58 API calls 67981->67982 67983 40b7d2 67982->67983 67984 44e565 58 API calls 67983->67984 67985 40b7eb 67984->67985 67986 44e565 58 API calls 67985->67986 67987 40b804 67986->67987 67988 419bd0 60 API calls 67987->67988 67989 40b819 67988->67989 67990 44e638 26 API calls 67989->67990 67991 40b82b 67990->67991 67992 44e4f1 ctype 23 API calls 67991->67992 67993 40b83b 67992->67993 67994 44e25e 27 API calls 67993->67994 67995 40b851 67994->67995 67996 422e20 106 API calls 67995->67996 67997 40b856 67996->67997 67998 45277e 32 API calls 67997->67998 67999 40b87b 67998->67999 68000 403a00 62 API calls 67999->68000 68001 40b8c2 68000->68001 68002 4039e0 InvalidateRect 68001->68002 68003 40b8d1 68002->68003 68004 44e565 58 API calls 68003->68004 68005 40b8e2 68004->68005 68006 403940 32 API calls 68005->68006 68007 40b8f4 68006->68007 68008 44e4f1 ctype 23 API calls 68007->68008 68009 40b904 68008->68009 68010 44e565 58 API calls 68009->68010 68011 40b915 68010->68011 68012 44e565 58 API calls 68011->68012 68013 40b92e 68012->68013 68014 44e565 58 API calls 68013->68014 68015 40b947 68014->68015 68016 419bd0 60 API calls 68015->68016 68017 40b95c 68016->68017 68018 44e638 26 API calls 68017->68018 68019 40b96e 68018->68019 68020 44e4f1 ctype 23 API calls 68019->68020 68021 40b97e 68020->68021 68022 44e25e 27 API calls 68021->68022 68023 40b994 68022->68023 68024 422e20 106 API calls 68023->68024 68025 40b999 68024->68025 68026 45277e 32 API calls 68025->68026 68027 40b9be 68026->68027 68028 403a00 62 API calls 68027->68028 68029 40ba05 68028->68029 68030 4039e0 InvalidateRect 68029->68030 68031 40ba14 68030->68031 68032 44e565 58 API calls 68031->68032 68033 40ba25 68032->68033 68034 403940 32 API calls 68033->68034 68035 40ba37 68034->68035 68036 44e4f1 ctype 23 API calls 68035->68036 68037 40ba47 68036->68037 68038 44e565 58 API calls 68037->68038 68039 40ba58 68038->68039 68040 44e565 58 API calls 68039->68040 68041 40ba71 68040->68041 68042 44e565 58 API calls 68041->68042 68043 40ba8a 68042->68043 68044 419bd0 60 API calls 68043->68044 68045 40ba9f 68044->68045 68046 44e638 26 API calls 68045->68046 68047 40bab1 68046->68047 68048 44e4f1 ctype 23 API calls 68047->68048 68049 40bac1 68048->68049 68050 44e25e 27 API calls 68049->68050 68051 40bad7 68050->68051 68052 422e20 106 API calls 68051->68052 68053 40badc 68052->68053 68054 45277e 32 API calls 68053->68054 68055 40bb01 68054->68055 68056 403a00 62 API calls 68055->68056 68057 40bb48 68056->68057 68058 4039e0 InvalidateRect 68057->68058 68059 40bb57 68058->68059 68060 44e565 58 API calls 68059->68060 68061 40bb68 68060->68061 68062 403940 32 API calls 68061->68062 68063 40bb7a 68062->68063 68064 44e4f1 ctype 23 API calls 68063->68064 68065 40bb8a 68064->68065 68066 44e565 58 API calls 68065->68066 68067 40bb9b 68066->68067 68068 44e565 58 API calls 68067->68068 68069 40bbb4 68068->68069 68070 44e565 58 API calls 68069->68070 68071 40bbcd 68070->68071 68072 419bd0 60 API calls 68071->68072 68073 40bbe2 68072->68073 68074 44e638 26 API calls 68073->68074 68075 40bbf4 68074->68075 68076 44e4f1 ctype 23 API calls 68075->68076 68077 40bc04 68076->68077 68078 44e25e 27 API calls 68077->68078 68079 40bc1a 68078->68079 68080 422e20 106 API calls 68079->68080 68081 40bc1f 68080->68081 68082 45277e 32 API calls 68081->68082 68083 40bc44 68082->68083 68084 403a00 62 API calls 68083->68084 68085 40bc8b 68084->68085 68086 4039e0 InvalidateRect 68085->68086 68087 40bc9a 68086->68087 68088 44e565 58 API calls 68087->68088 68089 40bcab 68088->68089 68090 403940 32 API calls 68089->68090 68091 40bcbd 68090->68091 68092 44e4f1 ctype 23 API calls 68091->68092 68093 40bccd 68092->68093 68094 44e565 58 API calls 68093->68094 68095 40bcde 68094->68095 68096 44e565 58 API calls 68095->68096 68097 40bcf7 68096->68097 68098 44e565 58 API calls 68097->68098 68099 40bd10 68098->68099 68100 419bd0 60 API calls 68099->68100 68101 40bd25 68100->68101 68102 44e638 26 API calls 68101->68102 68103 40bd37 68102->68103 68104 44e4f1 ctype 23 API calls 68103->68104 68105 40bd47 68104->68105 68106 44e25e 27 API calls 68105->68106 68107 40bd5d 68106->68107 68108 422e20 106 API calls 68107->68108 68109 40bd62 68108->68109 68110 45277e 32 API calls 68109->68110 68111 40bd87 68110->68111 68112 403a00 62 API calls 68111->68112 68113 40bdce 68112->68113 68114 4039e0 InvalidateRect 68113->68114 68115 40bddd 68114->68115 68116 44e565 58 API calls 68115->68116 68117 40bdee 68116->68117 68118 403940 32 API calls 68117->68118 68119 40be00 68118->68119 68120 44e4f1 ctype 23 API calls 68119->68120 68121 40be10 68120->68121 68122 44e565 58 API calls 68121->68122 68123 40be21 68122->68123 68124 44e565 58 API calls 68123->68124 68125 40be3a 68124->68125 68126 44e565 58 API calls 68125->68126 68127 40be53 68126->68127 68128 419bd0 60 API calls 68127->68128 68129 40be68 68128->68129 68130 44e638 26 API calls 68129->68130 68131 40be7a 68130->68131 68132 44e4f1 ctype 23 API calls 68131->68132 68133 40be8a 68132->68133 68134 44e25e 27 API calls 68133->68134 68135 40bea0 68134->68135 68136 422e20 106 API calls 68135->68136 68137 40bea5 68136->68137 68138 45277e 32 API calls 68137->68138 68139 40beca 68138->68139 68140 403a00 62 API calls 68139->68140 68141 40bf11 68140->68141 68142 4039e0 InvalidateRect 68141->68142 68143 40bf20 68142->68143 68144 44e565 58 API calls 68143->68144 68145 40bf31 68144->68145 68146 403940 32 API calls 68145->68146 68147 40bf43 68146->68147 68148 44e4f1 ctype 23 API calls 68147->68148 68149 40bf53 68148->68149 68150 44e565 58 API calls 68149->68150 68151 40bf64 68150->68151 68152 44e565 58 API calls 68151->68152 68153 40bf7d 68152->68153 68154 44e565 58 API calls 68153->68154 68155 40bf96 68154->68155 68156 419bd0 60 API calls 68155->68156 68157 40bfab 68156->68157 68158 44e638 26 API calls 68157->68158 68159 40bfbd 68158->68159 68160 44e4f1 ctype 23 API calls 68159->68160 68161 40bfcd 68160->68161 68162 44e25e 27 API calls 68161->68162 68163 40bfe3 68162->68163 68164 422e20 106 API calls 68163->68164 68165 40bfe8 68164->68165 68166 45277e 32 API calls 68165->68166 68167 40c00d 68166->68167 68168 403a00 62 API calls 68167->68168 68169 40c054 68168->68169 68170 4039e0 InvalidateRect 68169->68170 68171 40c063 68170->68171 68172 44e565 58 API calls 68171->68172 68173 40c074 68172->68173 68174 403940 32 API calls 68173->68174 68175 40c086 68174->68175 68176 44e4f1 ctype 23 API calls 68175->68176 68177 40c096 68176->68177 68178 44e565 58 API calls 68177->68178 68179 40c0a7 68178->68179 68180 44e565 58 API calls 68179->68180 68181 40c0c0 68180->68181 68182 44e565 58 API calls 68181->68182 68183 40c0d9 68182->68183 68184 419bd0 60 API calls 68183->68184 68185 40c0ee 68184->68185 68186 44e638 26 API calls 68185->68186 68187 40c100 68186->68187 68188 44e4f1 ctype 23 API calls 68187->68188 68189 40c110 68188->68189 68190 44e25e 27 API calls 68189->68190 68191 40c126 68190->68191 68192 422e20 106 API calls 68191->68192 68193 40c12b 68192->68193 68194 45277e 32 API calls 68193->68194 68195 40c150 68194->68195 68196 403a00 62 API calls 68195->68196 68197 40c197 68196->68197 68198 4039e0 InvalidateRect 68197->68198 68199 40c1a6 68198->68199 68200 44e565 58 API calls 68199->68200 68201 40c1b7 68200->68201 68202 403940 32 API calls 68201->68202 68203 40c1c9 68202->68203 68204 44e4f1 ctype 23 API calls 68203->68204 68205 40c1d9 68204->68205 68206 44e565 58 API calls 68205->68206 68207 40c1ea 68206->68207 68208 44e565 58 API calls 68207->68208 68209 40c203 68208->68209 68210 44e565 58 API calls 68209->68210 68211 40c21c 68210->68211 68212 419bd0 60 API calls 68211->68212 68213 40c231 68212->68213 68214 44e638 26 API calls 68213->68214 68215 40c243 68214->68215 68216 44e4f1 ctype 23 API calls 68215->68216 68217 40c253 68216->68217 68218 44e25e 27 API calls 68217->68218 68219 40c269 68218->68219 68220 422e20 106 API calls 68219->68220 68221 40c26e 68220->68221 68222 45277e 32 API calls 68221->68222 68223 40c293 68222->68223 68224 403a00 62 API calls 68223->68224 68225 40c2da 68224->68225 68226 4039e0 InvalidateRect 68225->68226 68227 40c2e9 68226->68227 68228 44e565 58 API calls 68227->68228 68229 40c2fa 68228->68229 68230 403940 32 API calls 68229->68230 68231 40c30c 68230->68231 68232 44e4f1 ctype 23 API calls 68231->68232 68233 40c31c 68232->68233 68234 44e565 58 API calls 68233->68234 68235 40c32d 68234->68235 68236 44e565 58 API calls 68235->68236 68237 40c346 68236->68237 68238 44e565 58 API calls 68237->68238 68239 40c35f 68238->68239 68240 419bd0 60 API calls 68239->68240 68241 40c374 68240->68241 68242 44e638 26 API calls 68241->68242 68243 40c386 68242->68243 68244 44e4f1 ctype 23 API calls 68243->68244 68245 40c396 68244->68245 68246 44e25e 27 API calls 68245->68246 68247 40c3ac 68246->68247 68248 422e20 106 API calls 68247->68248 68249 40c3b1 68248->68249 68250 45277e 32 API calls 68249->68250 69405 439c30 68844->69405 68847 44e565 58 API calls 68848 419c41 68847->68848 68849 44e4f1 ctype 23 API calls 68848->68849 68850 419c5d 68849->68850 68851 44e4f1 ctype 23 API calls 68850->68851 68852 419c71 68851->68852 68853 44e4f1 ctype 23 API calls 68852->68853 68854 419c85 68853->68854 68854->67696 68856 4082b1 68855->68856 68857 408281 _TrackMouseEvent 68855->68857 69407 4397f2 68856->69407 68857->68856 68860 4082f0 68862 44b268 23 API calls 68860->68862 68861 44e638 26 API calls 68863 4082db PostMessageW 68861->68863 68864 4082f7 68862->68864 68863->68860 68864->67696 68866 419b0d 68865->68866 68867 4515a6 49 API calls 68866->68867 68868 419b27 68867->68868 68869 45154f 48 API calls 68868->68869 68870 419b33 GetObjectW 68869->68870 68870->67696 68872 44e4f1 ctype 23 API calls 68871->68872 68873 419ef1 68872->68873 68874 44e4f1 ctype 23 API calls 68873->68874 68875 419f02 68874->68875 68875->67696 68877 44b301 49 API calls 68876->68877 68878 403c75 PostMessageW 68877->68878 68879 44e638 26 API calls 68878->68879 68880 403c9d PostMessageW 68879->68880 68880->67696 68882 451419 __EH_prolog 68881->68882 68883 451425 BeginPaint 68882->68883 68884 450c58 48 API calls 68883->68884 68885 45144b 68884->68885 68886 4080e7 GetClientRect 68885->68886 68887 45144f 68885->68887 68889 450ba1 68886->68889 68902 451606 RaiseException SendMessageW ctype 68887->68902 68889->67733 68891 408131 68890->68891 68892 450c68 68890->68892 68896 450d99 SelectObject 68891->68896 68903 450bd1 68892->68903 68894 450c6f 68911 44a1d7 20 API calls ctype 68894->68911 68913 45153a 68896->68913 68899->67742 68900->67744 68901->67746 68902->68886 68904 450bdb __EH_prolog 68903->68904 68905 4534ab ctype 28 API calls 68904->68905 68906 450be1 ctype 68905->68906 68907 44e22a ctype 20 API calls 68906->68907 68909 450c1f ctype 68906->68909 68908 450c03 68907->68908 68908->68909 68912 4502a3 20 API calls 2 library calls 68908->68912 68909->68894 68911->68891 68912->68909 68918 4514c8 68913->68918 68915 451541 68926 450308 68915->68926 68917 408146 BitBlt 68917->67738 68919 4514d2 __EH_prolog 68918->68919 68920 4534ab ctype 28 API calls 68919->68920 68921 4514d8 ctype 68920->68921 68922 44e22a ctype 20 API calls 68921->68922 68924 451516 ctype 68921->68924 68923 4514fa 68922->68923 68923->68924 68932 4502a3 20 API calls 2 library calls 68923->68932 68924->68915 68927 450312 __EH_prolog ctype 68926->68927 68928 450387 68927->68928 68931 450323 ctype 68927->68931 68933 449405 RaiseException ctype 68927->68933 68934 44a1d7 20 API calls ctype 68928->68934 68931->68917 68932->68924 68934->68931 68936 44daf7 68935->68936 68937 40a94f GetModuleFileNameW 68935->68937 68986 44af99 GetWindowLongW SetWindowLongW SetWindowPos 68936->68986 68937->67758 68987 4259c0 GetModuleFileNameW 68939->68987 68941 4257f4 68994 44e638 68941->68994 68952 44e4f1 ctype 23 API calls 68953 425855 68952->68953 68954 44e5ba 28 API calls 68953->68954 68955 425868 68954->68955 68956 44e5ba 28 API calls 68955->68956 68957 42587e 68956->68957 68958 419eb0 24 API calls 68957->68958 68959 42588c 68958->68959 68960 44e4f1 ctype 23 API calls 68959->68960 68961 42589c 68960->68961 68962 44e4f1 ctype 23 API calls 68961->68962 68963 4258ad 68962->68963 68963->67761 68965 4198e9 68964->68965 68966 41948d CreateCompatibleDC 68964->68966 68965->67765 68966->68965 68967 4194a0 GetObjectW CreateDIBSection 68966->68967 68968 419530 SelectObject CreateCompatibleDC 68967->68968 68969 4198cf DeleteDC 68967->68969 68970 419557 GetObjectW 68968->68970 68971 4198b8 SelectObject DeleteObject 68968->68971 68969->67765 68973 419575 68970->68973 68971->68969 68972 419595 SelectObject BitBlt GlobalAlloc GlobalLock SetRect 68984 419656 68972->68984 68973->68972 68974 41958e 68973->68974 68974->68972 68975 419861 ExtCreateRegion 68976 419893 68975->68976 68977 41987f CombineRgn DeleteObject 68975->68977 68978 419897 GlobalUnlock GlobalFree SelectObject DeleteDC 68976->68978 68977->68978 68978->68971 68979 419859 68979->68975 68980 419744 GlobalUnlock GlobalReAlloc GlobalLock 68981 41977e SetRect 68980->68981 68981->68984 68982 4197da ExtCreateRegion 68983 4197f2 CombineRgn DeleteObject 68982->68983 68982->68984 68985 41980a SetRect 68983->68985 68984->68975 68984->68979 68984->68980 68984->68981 68984->68982 68984->68985 68985->68984 68986->68937 68988 425a48 68987->68988 68990 425a66 68987->68990 68989 44e5ba 28 API calls 68988->68989 68991 425a5b 68989->68991 69029 44e565 68990->69029 68991->68941 68993 425ab7 68993->68941 68995 425806 68994->68995 68996 44e648 68994->68996 69002 44e4f1 68995->69002 68997 44e65f 68996->68997 68998 44e66c 68996->68998 69045 44e605 25 API calls ctype 68997->69045 69046 44e425 23 API calls ctype 68998->69046 69001 44e673 InterlockedIncrement 69001->68995 69003 44e501 InterlockedDecrement 69002->69003 69004 425814 69002->69004 69003->69004 69005 44e50f 69003->69005 69007 44e5ba 69004->69007 69047 44e3dd 22 API calls ctype 69005->69047 69008 44e5ce lstrlenA 69007->69008 69009 44e5d9 69007->69009 69008->69009 69010 425822 69009->69010 69011 44e359 ctype 22 API calls 69009->69011 69016 44e730 69010->69016 69012 44e5e7 69011->69012 69048 44e983 69012->69048 69014 44e5f1 69053 44e8fd 69014->69053 69017 44e73a __EH_prolog 69016->69017 69064 44e6ef 69017->69064 69019 44e769 69068 44e25e 69019->69068 69022 44e4f1 ctype 23 API calls 69023 42583e 69022->69023 69024 419b60 69023->69024 69025 44e638 26 API calls 69024->69025 69026 419b9d 69025->69026 69027 44e4f1 ctype 23 API calls 69026->69027 69028 419bae 69027->69028 69028->68952 69030 44e579 69029->69030 69036 44e58c ctype 69029->69036 69031 44e583 69030->69031 69032 44e58e lstrlenW 69030->69032 69037 4504c8 57 API calls ctype 69031->69037 69034 44e59b 69032->69034 69032->69036 69038 44e359 69034->69038 69036->68993 69037->69036 69040 44e36e 69038->69040 69043 44e365 69038->69043 69039 44e376 69041 432666 ctype 22 API calls 69039->69041 69040->69039 69042 44e3b5 69040->69042 69041->69043 69044 44e22a ctype 20 API calls 69042->69044 69043->69036 69044->69043 69045->68995 69046->69001 69047->69004 69049 44e997 MultiByteToWideChar 69048->69049 69050 44e98f 69048->69050 69052 44e9b0 69049->69052 69050->69049 69051 44e993 69050->69051 69051->69014 69052->69014 69058 44e497 69053->69058 69055 44e905 69056 44e916 69055->69056 69057 44e90e lstrlenW 69055->69057 69056->69010 69057->69056 69059 44e4a3 69058->69059 69063 44e4b2 ctype 69058->69063 69060 44e425 ctype 23 API calls 69059->69060 69061 44e4a8 69060->69061 69062 44e359 ctype 22 API calls 69061->69062 69062->69063 69063->69055 69065 44e703 69064->69065 69067 44e709 ctype 69064->69067 69066 44e359 ctype 22 API calls 69065->69066 69066->69067 69067->69019 69069 44e26d InterlockedIncrement 69068->69069 69070 44e27b 69068->69070 69071 44e28b 69069->69071 69073 44e688 26 API calls ctype 69070->69073 69071->69022 69073->69071 69074->67772 69076 45155f 69075->69076 69077 4221f7 69075->69077 69078 4514c8 48 API calls 69076->69078 69077->67781 69079 451566 69078->69079 69091 44a1d7 20 API calls ctype 69079->69091 69081->67787 69082->67791 69084 4515ac 69083->69084 69085 4515af 69083->69085 69084->67793 69092 45157c 48 API calls ctype 69085->69092 69087 4515b4 DeleteObject 69087->67793 69088->67797 69089->67799 69090->67801 69091->69077 69092->69087 69094 44b28f ctype 48 API calls 69093->69094 69095 44b30a 69094->69095 69096 450308 21 API calls 69095->69096 69097 44b317 69096->69097 69130 44dcf2 69097->69130 69099 44b321 69100 44b069 69099->69100 69134 44dab9 69100->69134 69102 44b07b 69103 44b0c3 69102->69103 69137 44c801 69102->69137 69103->67804 69105 44b089 69106 44c801 53 API calls 69105->69106 69107 44b095 69106->69107 69107->69103 69108 44b0ae SendMessageW 69107->69108 69108->69103 69110 449886 69109->69110 69112 4498b0 69109->69112 69110->69112 69145 44a4dc 26 API calls ctype 69110->69145 69111 4498d6 69111->67854 69114 44bb2b 2 API calls 69112->69114 69114->69111 69115->67811 69116->67819 69117->67854 69118->67819 69120 450bd1 ctype 48 API calls 69119->69120 69121 450c4a 69120->69121 69122 450308 21 API calls 69121->69122 69123 450c55 69122->69123 69123->67854 69124->67861 69125->67854 69126->67854 69127->67854 69128->67854 69129->67855 69131 44dcf9 69130->69131 69132 44dd15 ctype 69130->69132 69131->69132 69133 44dcff GetParent 69131->69133 69132->69099 69133->69132 69135 44dac0 GetWindowLongW 69134->69135 69136 44dacc 69134->69136 69135->69102 69138 44c805 69137->69138 69139 44c80c 69137->69139 69138->69139 69141 44c821 69138->69141 69144 44c7bc 53 API calls 69138->69144 69139->69105 69142 44b301 49 API calls 69141->69142 69143 44c827 69142->69143 69143->69105 69144->69138 69145->69112 69147 44e7a0 __EH_prolog 69146->69147 69148 44e7bf lstrlenW 69147->69148 69149 44e7bb 69147->69149 69148->69149 69150 44e6ef 22 API calls 69149->69150 69151 44e7dd 69150->69151 69152 44e25e 27 API calls 69151->69152 69153 44e7e9 69152->69153 69154 44e4f1 ctype 23 API calls 69153->69154 69155 40b2ca 69154->69155 69155->67874 69157 40b66b 69156->69157 69158 44db99 MoveWindow 69156->69158 69157->67954 69158->69157 69160 422e6a 69159->69160 69269 4487b6 69160->69269 69162 422e80 69163 44e4f1 ctype 23 API calls 69162->69163 69164 422e95 69163->69164 69280 448793 69164->69280 69168 422ecf 69287 44884c 69168->69287 69170 422f09 69171 44e4f1 ctype 23 API calls 69170->69171 69172 422f22 69171->69172 69173 44e565 58 API calls 69172->69173 69174 422f30 69173->69174 69298 448ce3 69174->69298 69176 422f41 69303 448c9a 69176->69303 69178 422f4a 69179 44e4f1 ctype 23 API calls 69178->69179 69180 422f6c 69179->69180 69181 44e4f1 ctype 23 API calls 69180->69181 69182 422f7d 69181->69182 69183 44e4f1 ctype 23 API calls 69182->69183 69184 40b713 69183->69184 69185 45277e 69184->69185 69187 44b8d5 32 API calls 69185->69187 69186 40b738 69188 403a00 69186->69188 69187->69186 69189 403a15 69188->69189 69190 403a0d 69188->69190 69192 403a24 69189->69192 69193 4515a6 49 API calls 69189->69193 69191 4515a6 49 API calls 69190->69191 69191->69189 69194 4515a6 49 API calls 69192->69194 69196 403a33 69192->69196 69193->69192 69194->69196 69195 403a42 GetDC 69198 450c43 48 API calls 69195->69198 69196->69195 69197 4515a6 49 API calls 69196->69197 69197->69195 69199 403a52 69198->69199 69339 419900 69199->69339 69202 419900 57 API calls 69203 403aaa 69202->69203 69204 419900 57 API calls 69203->69204 69205 403ad1 69204->69205 69206 419900 57 API calls 69205->69206 69207 403af8 69206->69207 69208 44daed 3 API calls 69207->69208 69209 403b0b ReleaseDC 69208->69209 69209->67973 69211 4039eb InvalidateRect 69210->69211 69212 4039fc 69210->69212 69211->69212 69212->67976 69214 403953 69213->69214 69215 4039c5 69214->69215 69216 40395a SendMessageW 69214->69216 69215->67980 69217 403977 GetClientRect 69216->69217 69218 403999 69216->69218 69368 44997e 69217->69368 69372 4499cc 69218->69372 69221 4039a7 SendMessageW 69222 44e638 26 API calls 69221->69222 69222->69215 69270 4487c0 __EH_prolog 69269->69270 69271 448802 69270->69271 69272 4487f7 69270->69272 69308 44e51b 22 API calls ctype 69271->69308 69275 44e25e 27 API calls 69272->69275 69274 44881e 69276 44e25e 27 API calls 69274->69276 69277 448800 69275->69277 69278 44882a 69276->69278 69277->69162 69279 44e4f1 ctype 23 API calls 69278->69279 69279->69277 69281 4487b6 28 API calls 69280->69281 69282 422ea8 69281->69282 69283 439d59 69282->69283 69284 439d75 69283->69284 69309 43e323 69284->69309 69288 448856 __EH_prolog 69287->69288 69289 448879 69288->69289 69290 44886b 69288->69290 69335 44e51b 22 API calls ctype 69289->69335 69291 44e25e 27 API calls 69290->69291 69293 448874 69291->69293 69293->69170 69294 44889b 69295 44e25e 27 API calls 69294->69295 69296 4488a7 69295->69296 69297 44e4f1 ctype 23 API calls 69296->69297 69297->69293 69299 44e497 25 API calls 69298->69299 69301 448cec 69299->69301 69302 448d00 ctype 69301->69302 69336 43a77b 69301->69336 69302->69176 69304 44e497 25 API calls 69303->69304 69305 448ca4 69304->69305 69306 43a77b 6 API calls 69305->69306 69307 448ccf 69305->69307 69306->69305 69307->69178 69308->69274 69324 43e330 ctype 69309->69324 69310 439d8a 69310->69168 69312 43edc8 69334 43ee57 30 API calls 69312->69334 69314 43a77b 6 API calls 69314->69324 69315 43ee70 48 API calls 69315->69324 69316 43ee57 30 API calls 69316->69324 69318 43edf2 12 API calls 69318->69324 69319 43ee4c 42 API calls 69319->69324 69320 439efc ctype 20 API calls 69320->69324 69321 441edb 6 API calls 69321->69324 69324->69310 69324->69312 69324->69314 69324->69315 69324->69316 69324->69318 69324->69319 69324->69320 69324->69321 69326 44040c 69324->69326 69330 442924 31 API calls ctype 69324->69330 69331 44163f 34 API calls ctype 69324->69331 69332 439f88 20 API calls ctype 69324->69332 69333 442737 30 API calls ctype 69324->69333 69327 440418 69326->69327 69329 440420 69326->69329 69328 442b5c 6 API calls 69327->69328 69327->69329 69328->69329 69329->69324 69330->69324 69331->69324 69332->69324 69333->69324 69334->69310 69335->69294 69337 44040c 6 API calls 69336->69337 69338 43a786 69337->69338 69338->69301 69340 403a83 69339->69340 69341 419927 69339->69341 69340->69202 69342 4515a6 49 API calls 69341->69342 69343 419951 69341->69343 69342->69343 69344 41996b CreateCompatibleBitmap 69343->69344 69345 45154f 48 API calls 69344->69345 69346 419988 CreateCompatibleDC 69345->69346 69348 450c58 48 API calls 69346->69348 69349 4199a4 69348->69349 69350 4199bb CreateCompatibleDC 69349->69350 69352 4199af SelectObject 69349->69352 69353 450c58 48 API calls 69350->69353 69352->69350 69354 4199d3 69353->69354 69355 4199ee StretchBlt 69354->69355 69356 4199e2 SelectObject 69354->69356 69364 450cc0 49 API calls ctype 69355->69364 69356->69355 69358 419a28 69365 450cc0 49 API calls ctype 69358->69365 69360 419a31 69366 450cd6 49 API calls 2 library calls 69360->69366 69362 419a3f 69367 450cd6 49 API calls 2 library calls 69362->69367 69364->69358 69365->69360 69366->69362 69367->69340 69375 449a03 69368->69375 69370 449996 ctype 69371 4499ad SendMessageW 69370->69371 69371->69218 69373 449a03 GetParent 69372->69373 69374 4499e4 SendMessageW 69373->69374 69374->69221 69376 449a15 ctype 69375->69376 69377 449a47 69376->69377 69378 449a31 GetParent 69376->69378 69377->69370 69378->69377 69406 419bef GetPrivateProfileStringW 69405->69406 69406->68847 69408 43984a InterlockedIncrement 69407->69408 69417 4082c9 69407->69417 69409 43985e InterlockedDecrement 69408->69409 69412 43986c 69408->69412 69410 43d7a4 ctype 20 API calls 69409->69410 69410->69412 69411 43d81a 14 API calls 69411->69412 69412->69411 69413 4398ab 69412->69413 69414 4398b2 69413->69414 69415 4398bc InterlockedDecrement 69413->69415 69418 43d805 LeaveCriticalSection 69414->69418 69415->69417 69417->68860 69417->68861 69418->69417 69420 44dab9 GetWindowLongW 69419->69420 69421 44d16f 69420->69421 69422 44d179 69421->69422 69424 44d184 GetParent 69421->69424 69425 44d18f GetWindow 69421->69425 69423 44d1b6 GetWindowRect 69422->69423 69427 44d1cf 69423->69427 69428 44d25a GetParent GetClientRect GetClientRect MapWindowPoints 69423->69428 69426 44d19a 69424->69426 69425->69426 69426->69423 69429 44d1a0 SendMessageW 69426->69429 69430 44d1d3 GetWindowLongW 69427->69430 69431 44d1e3 69427->69431 69437 44d287 69428->69437 69429->69423 69432 44d1b4 69429->69432 69430->69431 69433 44d1f7 69431->69433 69434 44d231 GetWindowRect 69431->69434 69432->69423 69454 431650 28 API calls 69433->69454 69457 431941 14 API calls 69434->69457 69450 44dbd0 69437->69450 69438 44d244 69458 4319ac 12 API calls 69438->69458 69439 44d1fc 69455 431941 14 API calls 69439->69455 69444 44d24a CopyRect 69444->69437 69445 44d20f 69456 4319ac 12 API calls 69445->69456 69448 44d215 CopyRect CopyRect 69448->69437 69449->67721 69451 44dbda SetWindowPos 69450->69451 69453 44d30a 69450->69453 69451->69453 69453->67711 69454->69439 69455->69445 69456->69448 69457->69438 69458->69444 69460 44e4d8 69459->69460 69461 44e4ec 69460->69461 69465 44e425 23 API calls ctype 69460->69465 69461->67440 69463 44e4e4 69464 44e359 ctype 22 API calls 69463->69464 69464->69461 69465->69463 69466->67450 69468 44e4f1 ctype 23 API calls 69467->69468 69469 419e70 69468->69469 69470 44e4f1 ctype 23 API calls 69469->69470 69471 419e87 69470->69471 69471->67484 69472->67484 69474 422ff0 69473->69474 69475 422fe7 RegCreateKeyW 69473->69475 69474->67497 69476 423000 RegQueryValueExW 69474->69476 69475->69474 69476->67499 69485 43e298 69477->69485 69480 423000 RegQueryValueExW 69480->67503 69481->67507 69482->67511 69483->67515 69484->67523 69487 43e2a0 69485->69487 69489 43e2ce 69487->69489 69491 441edb 6 API calls 69487->69491 69490 424763 69489->69490 69492 441edb 6 API calls 69489->69492 69490->69480 69491->69487 69492->69489 69494 448c53 69493->69494 69504 4489b3 69493->69504 69506 44e8ad 69494->69506 69499 44e8fd 26 API calls 69501 409d51 69499->69501 69500 439d30 7 API calls 69500->69504 69501->67531 69502 43a76d 6 API calls 69502->69504 69503 448bba lstrlenA 69503->69504 69504->69494 69504->69500 69504->69502 69504->69503 69505 448b6c lstrlenW 69504->69505 69505->69504 69507 44e8c0 69506->69507 69508 448c63 69507->69508 69509 44e359 ctype 22 API calls 69507->69509 69512 43a6c7 69508->69512 69510 44e8d7 ctype 69509->69510 69519 44e456 23 API calls ctype 69510->69519 69520 43fc28 69512->69520 69516 43a6fe 69517 43a71b 69516->69517 69528 43d88f 35 API calls ctype 69516->69528 69517->69499 69519->69508 69521 43a6f4 69520->69521 69525 43fc4f __aulldiv __aullrem ctype 69520->69525 69521->69516 69527 43d88f 35 API calls ctype 69521->69527 69522 440375 39 API calls 69522->69525 69523 440395 39 API calls 69523->69525 69524 4403c6 39 API calls 69524->69525 69525->69521 69525->69522 69525->69523 69525->69524 69526 442924 31 API calls 69525->69526 69526->69525 69527->69516 69528->69517 69529 402e00 69530 450c43 48 API calls 69529->69530 69531 402e31 69530->69531 69532 402e69 CreateCompatibleDC 69531->69532 69533 450c58 48 API calls 69532->69533 69534 402e7a 69533->69534 69535 450d99 49 API calls 69534->69535 69536 402f7c GetClientRect 69535->69536 69537 402fa2 GetClientRect 69536->69537 69538 403603 BitBlt 69536->69538 69540 402fb9 69537->69540 69539 403601 69538->69539 69541 450d99 49 API calls 69539->69541 69542 402fd4 CreateCompatibleDC 69540->69542 69543 403661 69541->69543 69544 450c58 48 API calls 69542->69544 69596 450cc0 49 API calls ctype 69543->69596 69546 402fe8 69544->69546 69549 402ff4 CreateCompatibleBitmap 69546->69549 69547 40366a 69597 450cd6 49 API calls 2 library calls 69547->69597 69551 45154f 48 API calls 69549->69551 69550 40367e 69552 403038 69551->69552 69553 450d99 49 API calls 69552->69553 69554 40305a BitBlt GdipCreateStringFormat GdipCreateFontFamilyFromName GdipCreateFont GdipCreateFromHDC 69553->69554 69555 403146 69554->69555 69556 403188 GdipCreateSolidFill 69555->69556 69592 4397b0 69556->69592 69559 403216 69560 40321a GdipSetStringFormatTrimming 69559->69560 69561 40322a 69560->69561 69562 40322e GdipSetTextRenderingHint 69560->69562 69561->69562 69563 40323d 69562->69563 69564 4032e3 69563->69564 69565 40324d GdipSetStringFormatAlign 69563->69565 69566 4032ec GdipSetStringFormatAlign 69564->69566 69567 40336e 69564->69567 69568 4032c6 69565->69568 69569 4032ca GdipSetStringFormatLineAlign 69565->69569 69566->69568 69566->69569 69572 403377 GdipSetStringFormatAlign 69567->69572 69573 403458 GdipSetStringFormatAlign 69567->69573 69568->69569 69570 403408 GdipDrawString 69569->69570 69571 4032de 69569->69571 69576 403456 69570->69576 69577 4034d9 BitBlt 69570->69577 69571->69570 69574 4033f0 69572->69574 69575 4033f4 GdipSetStringFormatLineAlign 69572->69575 69578 403473 69573->69578 69579 403477 GdipSetStringFormatLineAlign 69573->69579 69574->69575 69575->69570 69575->69571 69576->69577 69580 403532 69577->69580 69578->69579 69581 403487 69579->69581 69582 40348b GdipDrawString 69579->69582 69583 450d99 49 API calls 69580->69583 69581->69582 69582->69576 69582->69577 69584 403547 69583->69584 69585 4515a6 49 API calls 69584->69585 69586 403553 69585->69586 69594 450cc0 49 API calls ctype 69586->69594 69588 40355f 10 API calls 69589 4515a6 49 API calls 69588->69589 69590 4035ee 69589->69590 69595 450cd6 49 API calls 2 library calls 69590->69595 69593 403200 GdipSetStringFormatFlags 69592->69593 69593->69559 69593->69560 69594->69588 69595->69539 69596->69547 69597->69550 69598 409ec0 IsIconic 69599 409efb 69598->69599 69600 409f8f 69598->69600 69602 45140f 50 API calls 69599->69602 69601 45140f 50 API calls 69600->69601 69604 409f9d GetClientRect 69601->69604 69603 409f08 SendMessageW GetSystemMetrics GetSystemMetrics GetClientRect DrawIcon 69602->69603 69605 40a8c7 69603->69605 69606 409fbc 69604->69606 69684 451481 50 API calls 2 library calls 69605->69684 69609 409fd0 CreateCompatibleDC 69606->69609 69608 40a8de 69610 450c58 48 API calls 69609->69610 69611 409fff CreateCompatibleDC 69610->69611 69612 450c58 48 API calls 69611->69612 69613 40a023 69612->69613 69614 40a02c CreateCompatibleBitmap 69613->69614 69615 45154f 48 API calls 69614->69615 69616 40a073 69615->69616 69617 450d99 49 API calls 69616->69617 69618 40a08f 69617->69618 69619 450d99 49 API calls 69618->69619 69620 40a0af BitBlt GdipCreateStringFormat GdipCreateFontFamilyFromName GdipCreateFont GdipCreateFromHDC 69619->69620 69673 403d40 69620->69673 69623 40a214 69624 40a218 GdipSetStringFormatLineAlign 69623->69624 69625 40a228 69624->69625 69626 40a22c GdipSetStringFormatFlags 69624->69626 69625->69626 69627 40a243 GdipSetStringFormatTrimming 69626->69627 69628 40a23f 69626->69628 69629 40a253 69627->69629 69630 40a257 GdipSetTextRenderingHint 69627->69630 69628->69627 69629->69630 69631 40a266 69630->69631 69632 40a26a GdipDrawString 69630->69632 69631->69632 69633 40a2b2 69632->69633 69634 40a2b6 LoadStringW GdipDrawString 69632->69634 69633->69634 69635 40a355 69634->69635 69636 40a359 LoadStringW GdipSetStringFormatAlign 69634->69636 69635->69636 69637 40a3c3 GdipDrawString 69636->69637 69638 40a3bf 69636->69638 69639 40a40b 69637->69639 69640 40a40f LoadStringW GdipSetStringFormatAlign 69637->69640 69638->69637 69639->69640 69641 40a477 69640->69641 69642 40a47b GdipDrawString 69640->69642 69641->69642 69643 40a4c3 69642->69643 69644 40a4c7 LoadStringW GdipDrawString 69642->69644 69643->69644 69645 40a566 69644->69645 69646 40a56a LoadStringW GdipDrawString 69644->69646 69645->69646 69675 4145f0 69646->69675 69648 40a60f LoadStringW GdipSetStringFormatAlign 69676 4145d0 69648->69676 69650 40a67b GdipDrawString 69677 4145f0 69650->69677 69652 40a6c9 LoadStringW GdipSetStringFormatAlign 69678 4145d0 69652->69678 69654 40a736 GdipDrawString 69679 4145f0 69654->69679 69656 40a786 BitBlt 69657 40a7c8 69656->69657 69658 450d99 49 API calls 69657->69658 69659 40a7dd 69658->69659 69660 450d99 49 API calls 69659->69660 69661 40a7fa 69660->69661 69662 4515a6 49 API calls 69661->69662 69663 40a803 69662->69663 69680 450cc0 49 API calls ctype 69663->69680 69665 40a80f 69681 450cc0 49 API calls ctype 69665->69681 69667 40a818 10 API calls 69668 4515a6 49 API calls 69667->69668 69669 40a8a3 69668->69669 69682 450cd6 49 API calls 2 library calls 69669->69682 69671 40a8b7 69683 450cd6 49 API calls 2 library calls 69671->69683 69674 403d48 GdipCreateSolidFill LoadStringW GdipSetStringFormatAlign 69673->69674 69674->69623 69674->69624 69675->69648 69676->69650 69677->69652 69678->69654 69679->69656 69680->69665 69681->69667 69682->69671 69683->69605 69684->69608 69685 403900 69686 403940 32 API calls 69685->69686 69687 40390f SendMessageW 69686->69687 69690 44bb76 69687->69690 69691 453485 ctype 28 API calls 69690->69691 69692 403930 69691->69692 69693 454207 69698 454211 69693->69698 69695 45420c 69706 439b31 23 API calls 69695->69706 69697 454225 69699 454283 GetVersion 69698->69699 69700 4542c4 GetProcessVersion 69699->69700 69701 4542d6 69699->69701 69700->69701 69707 450470 KiUserCallbackDispatcher GetSystemMetrics 69701->69707 69703 4542dd 69714 45042c 7 API calls 69703->69714 69705 4542e7 LoadCursorW LoadCursorW 69705->69695 69706->69697 69708 450496 69707->69708 69709 45048f 69707->69709 69716 454261 GetSystemMetrics GetSystemMetrics 69708->69716 69715 454231 GetSystemMetrics GetSystemMetrics 69709->69715 69712 450494 69713 45049b GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 69712->69713 69713->69703 69714->69705 69715->69712 69716->69713 69717 44b541 69718 45407c ctype 7 API calls 69717->69718 69723 44b555 69718->69723 69721 44b59f 69722 44b5a3 69721->69722 69724 44b3e2 69721->69724 69723->69721 69751 44d027 7 API calls 69723->69751 69752 439e18 69724->69752 69726 44b3ec GetPropW 69727 44b4cc 69726->69727 69728 44b41f 69726->69728 69729 44b301 49 API calls 69727->69729 69730 44b428 69728->69730 69731 44b4ab 69728->69731 69732 44b4d4 69729->69732 69733 44b487 SetWindowLongW RemovePropW GlobalFindAtomW GlobalDeleteAtom 69730->69733 69734 44b42d 69730->69734 69735 44b301 49 API calls 69731->69735 69736 44b301 49 API calls 69732->69736 69738 44b4ea CallWindowProcW 69733->69738 69737 44b438 69734->69737 69734->69738 69739 44b4b1 69735->69739 69740 44b4dc 69736->69740 69741 44b301 49 API calls 69737->69741 69742 44b473 69738->69742 69754 44b0ca 57 API calls 69739->69754 69744 44b069 55 API calls 69740->69744 69745 44b43e 69741->69745 69742->69722 69747 44b4e6 69744->69747 69753 44afcd GetWindowRect GetWindowLongW 69745->69753 69746 44b4c3 69746->69747 69747->69738 69747->69742 69749 44b44e CallWindowProcW 69750 44aff0 86 API calls 69749->69750 69750->69742 69751->69721 69752->69726 69753->69749 69754->69746 69755 44f22d KiUserCallbackDispatcher 69756 44f244 69755->69756 69757 44f267 69755->69757 69756->69757 69758 44f259 TranslateMessage DispatchMessageW 69756->69758 69758->69757 69759 44b3ad 69760 44b3be 69759->69760 69761 44b3b9 69759->69761 69762 44b328 48 API calls 69760->69762 69763 44b3c6 69762->69763 69764 44b140 284 API calls 69763->69764 69764->69761 69765 408630 69766 439c30 69765->69766 69767 40864f CreateMutexW GetLastError 69766->69767 69768 408675 CloseHandle 69767->69768 69769 40869c 69767->69769 69857 431aa6 69769->69857 69774 4086ed 69871 421250 69774->69871 69778 408762 69942 44a9e5 69778->69942 69781 44e4f1 ctype 23 API calls 69782 408790 69781->69782 69783 44e4f1 ctype 23 API calls 69782->69783 69784 4087a4 69783->69784 69785 44e4f1 ctype 23 API calls 69784->69785 69786 4087b8 69785->69786 69787 44e4f1 ctype 23 API calls 69786->69787 69788 4087cc 69787->69788 69977 402ce0 53 API calls ctype 69788->69977 69790 4087e0 69978 402ce0 53 API calls ctype 69790->69978 69792 4087f4 69979 4024c0 53 API calls ctype 69792->69979 69794 408826 69980 402ce0 53 API calls ctype 69794->69980 69796 40883a 69981 402ce0 53 API calls ctype 69796->69981 69798 40884e 69982 402ce0 53 API calls ctype 69798->69982 69800 408862 69983 402ce0 53 API calls ctype 69800->69983 69802 408876 69984 402ce0 53 API calls ctype 69802->69984 69804 40888a 69985 402ce0 53 API calls ctype 69804->69985 69806 40889e 69986 402ce0 53 API calls ctype 69806->69986 69808 4088b2 69987 402ce0 53 API calls ctype 69808->69987 69810 4088c6 69988 402ce0 53 API calls ctype 69810->69988 69812 4088da 69989 402ce0 53 API calls ctype 69812->69989 69814 4088ee 69990 407d00 53 API calls ctype 69814->69990 69816 408902 69991 407d00 53 API calls ctype 69816->69991 69818 408916 69992 407d00 53 API calls ctype 69818->69992 69820 40892a 69993 402ce0 53 API calls ctype 69820->69993 69822 40895f 69994 402ce0 53 API calls ctype 69822->69994 69824 408973 69995 402ce0 53 API calls ctype 69824->69995 69826 408987 69996 402ce0 53 API calls ctype 69826->69996 69828 40899b 69997 402ce0 53 API calls ctype 69828->69997 69830 4089af 69998 402ce0 53 API calls ctype 69830->69998 69832 408a02 69999 402ce0 53 API calls ctype 69832->69999 69834 408a16 70000 402ce0 53 API calls ctype 69834->70000 69836 408a2a 70001 402ce0 53 API calls ctype 69836->70001 69838 408a3e 70002 402ce0 53 API calls ctype 69838->70002 69840 408a52 70003 402ce0 53 API calls ctype 69840->70003 69842 408a66 70004 402ce0 53 API calls ctype 69842->70004 69844 408a7a 70005 402ce0 53 API calls ctype 69844->70005 69846 408a8e 70006 402ce0 53 API calls ctype 69846->70006 69848 408aa2 69849 4515a6 49 API calls 69848->69849 69850 408acc 69849->69850 70007 402340 49 API calls 69850->70007 69852 408aeb 69853 44e4f1 ctype 23 API calls 69852->69853 69854 408afc 69853->69854 70008 44a6b8 49 API calls 2 library calls 69854->70008 69856 408b10 69858 431abe 69857->69858 69859 431aaf 69857->69859 69861 453485 ctype 28 API calls 69858->69861 69860 45407c ctype 7 API calls 69859->69860 69860->69858 69862 4086a2 69861->69862 69863 453a1d 69862->69863 69864 453a31 69863->69864 69865 4086ac GetModuleFileNameW 69863->69865 69866 45407c ctype 7 API calls 69864->69866 69865->69774 69867 453a40 69866->69867 69868 453485 ctype 28 API calls 69867->69868 69869 453a8b 69867->69869 69868->69869 69869->69865 69870 453485 ctype 28 API calls 69869->69870 69870->69865 69872 408726 GdiplusStartup 69871->69872 69873 421259 69871->69873 69880 4098f0 69872->69880 69874 421268 69873->69874 70009 44e253 20 API calls ctype 69873->70009 69876 44e22a ctype 20 API calls 69874->69876 69877 421281 69876->69877 69878 453485 ctype 28 API calls 69877->69878 69879 4212a4 GetCurrentThreadId SetWindowsHookExW 69878->69879 69879->69872 69881 40991a 69880->69881 69882 44e5ba 28 API calls 69881->69882 69883 409931 69882->69883 69884 419b60 27 API calls 69883->69884 69885 409939 69884->69885 70010 402b90 69885->70010 69888 402b90 73 API calls 69889 40996a 69888->69889 69890 402b90 73 API calls 69889->69890 69891 40997a 69890->69891 69892 402b90 73 API calls 69891->69892 69893 40998a 69892->69893 69894 402b90 73 API calls 69893->69894 69895 40999a 69894->69895 69896 402b90 73 API calls 69895->69896 69897 4099aa 69896->69897 69898 402b90 73 API calls 69897->69898 69899 4099ba 69898->69899 69900 402b90 73 API calls 69899->69900 69901 4099ca 69900->69901 69902 402b90 73 API calls 69901->69902 69903 4099da 69902->69903 69904 402b90 73 API calls 69903->69904 69905 409a2b 69904->69905 69906 402b90 73 API calls 69905->69906 69907 409a3b 69906->69907 69908 402b90 73 API calls 69907->69908 69909 409a4b 69908->69909 69910 402b90 73 API calls 69909->69910 69911 409a5b 69910->69911 69912 402b90 73 API calls 69911->69912 69913 409a6b 69912->69913 69914 402b90 73 API calls 69913->69914 69915 409acd 69914->69915 69916 402b90 73 API calls 69915->69916 69917 409add 69916->69917 69918 402b90 73 API calls 69917->69918 69919 409aed 69918->69919 69920 402b90 73 API calls 69919->69920 69921 409afd 69920->69921 69922 402b90 73 API calls 69921->69922 69923 409b0d 69922->69923 69924 402b90 73 API calls 69923->69924 69925 409b1d 69924->69925 69926 402b90 73 API calls 69925->69926 69927 409b2d 69926->69927 69928 402b90 73 API calls 69927->69928 69929 409b3d 69928->69929 69930 402b90 73 API calls 69929->69930 69931 409b4d 69930->69931 69932 402b90 73 API calls 69931->69932 69933 409b5d 69932->69933 69934 402b90 73 API calls 69933->69934 69935 409b9c 69934->69935 69936 402b90 73 API calls 69935->69936 69937 409bac 69936->69937 69938 453485 ctype 28 API calls 69937->69938 69939 409beb 69938->69939 69940 453485 ctype 28 API calls 69939->69940 69941 409bf0 LoadIconW 69940->69941 69941->69778 69943 44a9ef __EH_prolog 69942->69943 69944 453485 ctype 28 API calls 69943->69944 69945 44aa0b 69944->69945 69946 44aa32 69945->69946 69947 453485 ctype 28 API calls 69945->69947 69948 44aa36 LockResource 69946->69948 69949 44aa40 69946->69949 69950 44aa19 FindResourceW LoadResource 69947->69950 69948->69949 69976 408779 69949->69976 70103 44a969 69949->70103 69950->69946 69953 44b7ad 29 API calls 69954 44aa5d 69953->69954 69955 44aa85 69954->69955 69956 44aa67 IsWindowEnabled 69954->69956 69958 44b761 23 API calls 69955->69958 69956->69955 69957 44aa74 EnableWindow 69956->69957 69957->69955 69959 44aa8e 69958->69959 69960 44b301 49 API calls 69959->69960 69961 44aa96 69960->69961 70112 44a6f6 69961->70112 69963 44ab01 EnableWindow 69964 44ab0c 69963->69964 69967 44ab25 69964->69967 69968 44ab11 GetActiveWindow 69964->69968 69966 44aac6 69970 44dbd0 SetWindowPos 69966->69970 69973 44aadc 69966->69973 70166 44a9a3 51 API calls ctype 69967->70166 69968->69967 69971 44ab1c SetActiveWindow 69968->69971 69969 44dab9 GetWindowLongW 69972 44aab6 69969->69972 69970->69973 69971->69967 70145 44d4b0 69972->70145 69973->69963 69973->69964 69976->69781 69977->69790 69978->69792 69979->69794 69980->69796 69981->69798 69982->69800 69983->69802 69984->69804 69985->69806 69986->69808 69987->69810 69988->69812 69989->69814 69990->69816 69991->69818 69992->69820 69993->69822 69994->69824 69995->69826 69996->69828 69997->69830 69998->69832 69999->69834 70000->69836 70001->69838 70002->69840 70003->69842 70004->69844 70005->69846 70006->69848 70007->69852 70008->69856 70009->69874 70011 402bb5 70010->70011 70012 44e6af 28 API calls 70011->70012 70013 402c5c 70012->70013 70014 44e6af 28 API calls 70013->70014 70015 402c68 70014->70015 70018 403880 70015->70018 70019 402ca7 70018->70019 70020 4038a0 70018->70020 70019->69888 70021 44e22a ctype 20 API calls 70020->70021 70022 4038a7 70021->70022 70025 4497b3 70022->70025 70030 44d6f2 70025->70030 70028 44b7ef 32 API calls 70029 4038da SendMessageW 70028->70029 70029->70019 70031 453485 ctype 28 API calls 70030->70031 70032 44d6fd ctype 70031->70032 70033 453485 ctype 28 API calls 70032->70033 70082 4497c2 70032->70082 70034 44d735 70033->70034 70035 44d766 70034->70035 70085 44be86 32 API calls 2 library calls 70034->70085 70037 44d787 70035->70037 70086 44be86 32 API calls 2 library calls 70035->70086 70038 44d7ae 70037->70038 70087 44be86 32 API calls 2 library calls 70037->70087 70041 44d7d4 70038->70041 70088 44d63a 34 API calls ctype 70038->70088 70043 44d801 70041->70043 70089 44d63a 34 API calls ctype 70041->70089 70045 44d80d 70043->70045 70046 44d82a 70043->70046 70090 44d67b 6 API calls 70045->70090 70048 44d844 70046->70048 70049 44d822 70046->70049 70051 44d861 70048->70051 70052 44d842 70048->70052 70049->70046 70091 44d67b 6 API calls 70049->70091 70054 44d87a 70051->70054 70055 44d85f 70051->70055 70052->70048 70092 44d67b 6 API calls 70052->70092 70057 44d878 70054->70057 70058 44d897 70054->70058 70055->70051 70093 44d67b 6 API calls 70055->70093 70057->70054 70094 44d67b 6 API calls 70057->70094 70060 44d8b4 70058->70060 70061 44d895 70058->70061 70063 44d8d1 70060->70063 70064 44d8b2 70060->70064 70061->70058 70095 44d67b 6 API calls 70061->70095 70066 44d8ee 70063->70066 70067 44d8cf 70063->70067 70064->70060 70096 44d67b 6 API calls 70064->70096 70069 44d8ec 70066->70069 70070 44d90b 70066->70070 70067->70063 70097 44d67b 6 API calls 70067->70097 70069->70066 70098 44d67b 6 API calls 70069->70098 70072 44d924 70070->70072 70073 44d909 70070->70073 70075 44d93d 70072->70075 70076 44d922 70072->70076 70073->70070 70099 44d67b 6 API calls 70073->70099 70078 44d93b 70075->70078 70079 44d95a 70075->70079 70076->70072 70100 44d67b 6 API calls 70076->70100 70078->70075 70101 44d67b 6 API calls 70078->70101 70081 44d958 70079->70081 70079->70082 70081->70079 70102 44d67b 6 API calls 70081->70102 70082->70028 70084 44d975 70084->70082 70085->70035 70086->70037 70087->70038 70088->70041 70089->70043 70090->70049 70091->70052 70092->70055 70093->70057 70094->70061 70095->70064 70096->70067 70097->70069 70098->70073 70099->70076 70100->70078 70101->70081 70102->70084 70104 453485 ctype 28 API calls 70103->70104 70105 44a972 70104->70105 70106 44a982 70105->70106 70184 452040 28 API calls 70105->70184 70167 4521e6 70106->70167 70110 44b761 23 API calls 70111 44a99e 70110->70111 70111->69953 70113 44a700 __EH_prolog 70112->70113 70114 44a71a 70113->70114 70115 453485 ctype 28 API calls 70113->70115 70116 453485 ctype 28 API calls 70114->70116 70115->70114 70117 44a725 70116->70117 70118 44d6f2 40 API calls 70117->70118 70119 44a73e 70118->70119 70120 44d6f2 40 API calls 70119->70120 70122 44a748 70120->70122 70143 44a900 70122->70143 70187 44ffb0 70122->70187 70123 44a79b 70124 44a7ab GetSystemMetrics 70123->70124 70132 44a7bb 70123->70132 70126 44a840 70124->70126 70124->70132 70128 44b761 23 API calls 70126->70128 70127 44a809 70193 45010f 10 API calls 70127->70193 70129 44a84e CreateDialogIndirectParamW 70128->70129 70134 44e4f1 ctype 23 API calls 70129->70134 70131 44a818 70194 44fe8e GlobalFree 70131->70194 70132->70126 70192 44fdff GlobalAlloc GlobalLock GlobalUnlock 70132->70192 70136 44a87d 70134->70136 70139 44b7ad 29 API calls 70136->70139 70137 44a82f 70137->70126 70138 44a834 GlobalLock 70137->70138 70138->70126 70140 44a8c4 70139->70140 70141 44a8e9 70140->70141 70142 44a8dd DestroyWindow 70140->70142 70141->70143 70144 44a8ee GlobalUnlock GlobalFree 70141->70144 70142->70141 70143->69966 70143->69969 70143->69973 70144->70143 70146 44d4d2 GetParent 70145->70146 70147 44d4cd 70145->70147 70196 44ecbb 70146->70196 70148 44dab9 GetWindowLongW 70147->70148 70148->70146 70151 44d4f7 70152 44d508 PeekMessageW 70151->70152 70153 44d51d 70151->70153 70156 44d55c SendMessageW 70151->70156 70157 44d5f3 70151->70157 70158 44d542 SendMessageW 70151->70158 70160 44d5a5 70151->70160 70161 44d5f9 70151->70161 70164 44ecbb 28 API calls 70151->70164 70165 44d5df PeekMessageW 70151->70165 70152->70151 70201 44dc1f ShowWindow 70153->70201 70155 44d526 UpdateWindow 70155->70151 70156->70151 70203 4560f4 29 API calls 70157->70203 70158->70151 70202 44dc1f ShowWindow 70160->70202 70161->69966 70163 44d5ae UpdateWindow 70163->70151 70164->70151 70165->70151 70166->69976 70168 45225f GetWindowLongW 70167->70168 70169 4521fa 70167->70169 70171 45226f GetParent 70168->70171 70172 45220c 70168->70172 70185 452282 21 API calls 70169->70185 70176 452208 70171->70176 70173 452216 GetParent 70172->70173 70174 45221f 70172->70174 70173->70173 70173->70174 70177 452230 70174->70177 70178 452227 GetLastActivePopup 70174->70178 70175 4521ff 70175->70176 70186 431650 28 API calls 70175->70186 70176->70168 70176->70172 70179 44a996 70177->70179 70181 45223c IsWindowEnabled 70177->70181 70178->70177 70179->70110 70181->70179 70182 452247 70181->70182 70182->70179 70183 45224b EnableWindow 70182->70183 70183->70179 70184->70106 70185->70175 70186->70176 70188 44ffbd 70187->70188 70189 44ffc8 70188->70189 70195 44e688 26 API calls ctype 70188->70195 70189->70123 70191 44fffa 70191->70123 70192->70127 70193->70131 70194->70137 70195->70191 70197 4534ab ctype 28 API calls 70196->70197 70198 44ecc0 70197->70198 70199 44eccc 70198->70199 70200 453485 ctype 28 API calls 70198->70200 70199->70151 70200->70199 70201->70155 70202->70163 70203->70161 70204 407f30 70205 44b268 23 API calls 70204->70205 70206 407f3b 70205->70206 70207 407f40 70206->70207 70212 421c90 GetModuleHandleW LoadImageW 70206->70212 70209 407f83 70210 422310 2 API calls 70209->70210 70211 407f8b 70210->70211 70213 421d13 70212->70213 70214 421d1f GetObjectW 70212->70214 70213->70209 70215 44b8d5 32 API calls 70214->70215 70216 421d8c GetWindowLongW SetWindowLongW 70215->70216 70217 421db1 70216->70217 70218 421db8 70216->70218 70220 4223b0 70217->70220 70218->70209 70247 4512a7 70220->70247 70222 4223db 70223 422411 GetWindowRect CreateCompatibleDC 70222->70223 70224 450c58 48 API calls 70223->70224 70225 422448 70224->70225 70226 450d99 49 API calls 70225->70226 70227 42245e CreateRectRgn 70226->70227 70228 45154f 48 API calls 70227->70228 70229 422490 GetPixel 70228->70229 70230 4224b7 70229->70230 70237 422544 70229->70237 70234 4224cf GetPixel 70230->70234 70230->70237 70231 42255f SetWindowRgn 70233 4515a6 49 API calls 70231->70233 70232 450d99 49 API calls 70232->70231 70235 422591 70233->70235 70234->70230 70236 4224e2 CreateRectRgn 70234->70236 70238 4515a6 49 API calls 70235->70238 70239 45154f 48 API calls 70236->70239 70237->70231 70237->70232 70240 4225a3 70238->70240 70241 4224f8 CombineRgn 70239->70241 70255 450cd6 49 API calls 2 library calls 70240->70255 70243 4515a6 49 API calls 70241->70243 70243->70230 70244 4225b1 70256 451319 50 API calls 2 library calls 70244->70256 70246 4225c2 70246->70218 70248 4512b1 __EH_prolog 70247->70248 70249 4512d1 GetDC 70248->70249 70250 450c58 48 API calls 70249->70250 70251 4512e3 70250->70251 70252 4512e7 70251->70252 70253 4512ec 70251->70253 70257 451606 RaiseException SendMessageW ctype 70252->70257 70253->70222 70255->70244 70256->70246 70257->70253 70258 419d90 GetPrivateProfileStructW 70259 44e4f1 ctype 23 API calls 70258->70259 70260 419dd6 70259->70260 70261 44e4f1 ctype 23 API calls 70260->70261 70262 419de7 70261->70262 70263 44b5bd 70264 453fe7 ctype 21 API calls 70263->70264 70265 44b5d3 70264->70265 70266 44b5f5 70265->70266 70267 44b5de CallNextHookEx 70265->70267 70268 453485 ctype 28 API calls 70266->70268 70274 44b6a4 70267->70274 70269 44b607 70268->70269 70270 44b6ad 70269->70270 70273 44b619 70269->70273 70292 44b346 49 API calls ctype 70270->70292 70272 44b680 CallNextHookEx 70272->70274 70275 44b697 UnhookWindowsHookEx 70272->70275 70273->70272 70276 44b626 GetWindowLongW 70273->70276 70275->70274 70276->70272 70277 44b636 GetPropW 70276->70277 70277->70272 70278 44b647 SetPropW GetPropW 70277->70278 70278->70272 70279 44b65f GlobalAddAtomW 70278->70279 70280 44b676 SetWindowLongW 70279->70280 70281 44b671 70279->70281 70280->70272 70281->70280 70282 44b742 70283 44b74a SetWindowLongW 70282->70283 70284 44b736 70283->70284 70284->70272 70285 44b6b5 70285->70282 70286 44b140 284 API calls 70285->70286 70287 44b6f8 70286->70287 70287->70282 70288 44b6ff 70287->70288 70289 44b704 GetWindowLongW 70288->70289 70290 44b721 70289->70290 70290->70284 70291 44b725 SetWindowLongW 70290->70291 70291->70284 70292->70285 70293 44045e 70294 440471 ctype 70293->70294 70295 4404aa HeapAlloc 70294->70295 70296 43d7a4 ctype 20 API calls 70294->70296 70297 43f244 ctype 5 API calls 70294->70297 70299 4404d5 ctype 70294->70299 70300 43d805 LeaveCriticalSection 70294->70300 70295->70294 70295->70299 70296->70294 70297->70294 70300->70294 70301 44a57e 70302 44bb76 28 API calls 70301->70302 70303 44a58c 70302->70303 70304 44a5a1 70303->70304 70316 44c86d 50 API calls 70303->70316 70306 44a60a 70317 44d480 70306->70317 70307 44a597 70307->70304 70307->70306 70308 44a5bb GetWindowLongW 70307->70308 70308->70306 70310 44a5c9 70308->70310 70321 451c99 GetClassNameW lstrcmpiW 70310->70321 70312 44a5d5 70312->70306 70313 44a5d9 GetDlgItem 70312->70313 70314 44a5f3 SendMessageW 70313->70314 70315 44a5e8 IsWindowEnabled 70313->70315 70314->70304 70315->70306 70315->70314 70316->70307 70318 44d48e 70317->70318 70319 44d4a9 70318->70319 70322 44da86 70318->70322 70319->70304 70321->70312 70323 44da8f 70322->70323 70324 44daa8 IsDialogMessageW 70322->70324 70325 453485 ctype 28 API calls 70323->70325 70326 44da94 70324->70326 70325->70326 70326->70319 70327 43909c GetVersion 70360 43c72d HeapCreate 70327->70360 70329 4390fa 70330 439107 70329->70330 70331 4390ff 70329->70331 70367 43c65f 28 API calls ctype 70330->70367 70375 4391c8 8 API calls ctype 70331->70375 70335 43910c 70336 439110 70335->70336 70337 439118 70335->70337 70376 4391c8 8 API calls ctype 70336->70376 70368 43c4a3 25 API calls ctype 70337->70368 70341 439122 70369 43c402 26 API calls ctype 70341->70369 70343 439127 70370 43c295 29 API calls ctype 70343->70370 70345 439131 70377 43c06c 21 API calls ctype 70345->70377 70347 43913b 70371 43bfb4 20 API calls ctype 70347->70371 70349 439140 70350 439145 GetStartupInfoW 70349->70350 70351 439157 70350->70351 70352 439160 70351->70352 70353 439169 GetModuleHandleA 70352->70353 70372 448687 70353->70372 70357 439184 70379 43bdf7 27 API calls ctype 70357->70379 70359 439195 70361 43c762 70360->70361 70362 43c74d 70360->70362 70361->70329 70380 43eeb0 HeapAlloc 70362->70380 70364 43c752 70365 43c756 HeapDestroy 70364->70365 70366 43c765 70364->70366 70365->70361 70366->70329 70367->70335 70368->70341 70369->70343 70370->70345 70371->70349 70381 450b2b 70372->70381 70377->70347 70378 43a7e4 23 API calls 70378->70357 70379->70359 70380->70364 70382 44ecbb 28 API calls 70381->70382 70383 450b36 70382->70383 70384 453485 ctype 28 API calls 70383->70384 70385 450b3d 70384->70385 70390 45452e SetErrorMode SetErrorMode 70385->70390 70388 43917b 70388->70378 70391 453485 ctype 28 API calls 70390->70391 70392 454545 70391->70392 70393 453485 ctype 28 API calls 70392->70393 70394 454554 70393->70394 70395 45457a 70394->70395 70402 454591 70394->70402 70397 453485 ctype 28 API calls 70395->70397 70398 45457f 70397->70398 70399 450b55 70398->70399 70420 44ecd0 70398->70420 70401 45620d 31 API calls ctype 70399->70401 70401->70388 70403 453485 ctype 28 API calls 70402->70403 70404 4545a4 GetModuleFileNameW 70403->70404 70405 4545d6 70404->70405 70431 4546b0 lstrlenW lstrcpynW 70405->70431 70407 4545f3 70408 454609 70407->70408 70436 43a789 20 API calls ctype 70407->70436 70419 454643 70408->70419 70432 45054c 70408->70432 70410 45465b lstrcpyW 70438 43a789 20 API calls ctype 70410->70438 70413 454686 lstrcatW 70439 43a789 20 API calls ctype 70413->70439 70414 4546a4 70414->70395 70416 454675 70416->70413 70416->70414 70419->70410 70419->70416 70421 453485 ctype 28 API calls 70420->70421 70422 44ecd5 70421->70422 70423 44ed2d 70422->70423 70440 453253 70422->70440 70423->70399 70426 45407c ctype 7 API calls 70427 44ed0b 70426->70427 70428 44ed18 70427->70428 70429 453485 ctype 28 API calls 70427->70429 70430 453fe7 ctype 21 API calls 70428->70430 70429->70428 70430->70423 70431->70407 70433 453485 ctype 28 API calls 70432->70433 70434 450552 LoadStringW 70433->70434 70435 45056d 70434->70435 70437 43a789 20 API calls ctype 70435->70437 70436->70408 70437->70419 70438->70416 70439->70414 70441 453fe7 ctype 21 API calls 70440->70441 70442 44ece1 GetCurrentThreadId SetWindowsHookExW 70441->70442 70442->70426

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 0 409ec0-409ef5 IsIconic 1 409efb-409f8a call 45140f SendMessageW GetSystemMetrics * 2 GetClientRect DrawIcon 0->1 2 409f8f-40a078 call 45140f GetClientRect call 450ba1 * 2 CreateCompatibleDC call 450c58 CreateCompatibleDC call 450c58 call 403cd0 CreateCompatibleBitmap call 45154f 0->2 7 40a8d9-40a8f5 call 451481 1->7 22 40a07a-40a07c 2->22 23 40a07e 2->23 24 40a081-40a212 call 450d99 * 2 BitBlt GdipCreateStringFormat GdipCreateFontFamilyFromName GdipCreateFont GdipCreateFromHDC call 403d40 GdipCreateSolidFill LoadStringW GdipSetStringFormatAlign 22->24 23->24 31 40a214 24->31 32 40a218-40a226 GdipSetStringFormatLineAlign 24->32 31->32 33 40a228 32->33 34 40a22c-40a23d GdipSetStringFormatFlags 32->34 33->34 35 40a243-40a251 GdipSetStringFormatTrimming 34->35 36 40a23f 34->36 37 40a253 35->37 38 40a257-40a264 GdipSetTextRenderingHint 35->38 36->35 37->38 39 40a266 38->39 40 40a26a-40a2b0 GdipDrawString 38->40 39->40 41 40a2b2 40->41 42 40a2b6-40a353 LoadStringW GdipDrawString 40->42 41->42 43 40a355 42->43 44 40a359-40a3bd LoadStringW GdipSetStringFormatAlign 42->44 43->44 45 40a3c3-40a409 GdipDrawString 44->45 46 40a3bf 44->46 47 40a40b 45->47 48 40a40f-40a475 LoadStringW GdipSetStringFormatAlign 45->48 46->45 47->48 49 40a477 48->49 50 40a47b-40a4c1 GdipDrawString 48->50 49->50 51 40a4c3 50->51 52 40a4c7-40a564 LoadStringW GdipDrawString 50->52 51->52 53 40a566 52->53 54 40a56a-40a7c6 LoadStringW GdipDrawString call 4145f0 LoadStringW GdipSetStringFormatAlign call 4145d0 GdipDrawString call 4145f0 LoadStringW GdipSetStringFormatAlign call 4145d0 GdipDrawString call 4145f0 BitBlt 52->54 53->54 65 40a7c8-40a7ca 54->65 66 40a7cc 54->66 67 40a7cf-40a7e6 call 450d99 65->67 66->67 70 40a7e8-40a7ea 67->70 71 40a7ec 67->71 72 40a7ef-40a8d2 call 450d99 call 4515a6 call 450cc0 * 2 DeleteObject * 4 ReleaseDC GdipDeleteBrush GdipDeleteGraphics GdipDeleteFont GdipDeleteFontFamily GdipDeleteStringFormat call 4515a6 call 450cd6 * 2 70->72 71->72 72->7
                                                                                          APIs
                                                                                          • IsIconic.USER32(?), ref: 00409EEB
                                                                                          • SendMessageW.USER32(?,00000027,?,00000000), ref: 00409F24
                                                                                          • GetSystemMetrics.USER32(0000000B), ref: 00409F32
                                                                                          • GetSystemMetrics.USER32(0000000C), ref: 00409F38
                                                                                          • GetClientRect.USER32(?,?), ref: 00409F45
                                                                                          • DrawIcon.USER32(?,?,?,?), ref: 00409F7D
                                                                                            • Part of subcall function 00451481: __EH_prolog.LIBCMT ref: 00451486
                                                                                            • Part of subcall function 00451481: EndPaint.USER32(?,?,00000000,?,00401171,?,00000000), ref: 004514A3
                                                                                          • GetClientRect.USER32(?,?), ref: 00409FAD
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00409FF3
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0040A014
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040A063
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0040A0FB
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CompatibleCreate$ClientH_prologMetricsPaintRectSystem$BeginBitmapDrawIconIconicMessageSend
                                                                                          • String ID: Arial$`=@$hE
                                                                                          • API String ID: 919260115-2905065322
                                                                                          • Opcode ID: ddcdc4fab3c0ec224e7a835cbc4e27f881350a942891f1ca9c837938dbf1608c
                                                                                          • Instruction ID: b6e94536598d63afcc03a7f4bd72992bccb19fdcb0ea026f8400423346eeb9f5
                                                                                          • Opcode Fuzzy Hash: ddcdc4fab3c0ec224e7a835cbc4e27f881350a942891f1ca9c837938dbf1608c
                                                                                          • Instruction Fuzzy Hash: 5E5239B1218345AFD318DF64C881EABB7E9BBC8704F148E2EF59587290D774E909CB52

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1700 44a9e5-44aa12 call 439e18 call 453485 1705 44aa14-44aa30 call 453485 FindResourceW LoadResource 1700->1705 1706 44aa32-44aa34 1700->1706 1705->1706 1708 44aa36-44aa3d LockResource 1706->1708 1709 44aa40-44aa44 1706->1709 1708->1709 1711 44aa46-44aa49 1709->1711 1712 44aa4e-44aa65 call 44a969 call 44b7ad 1709->1712 1713 44ab36-44ab44 1711->1713 1718 44aa85-44aaa4 call 44b761 call 44b301 call 44a6f6 1712->1718 1719 44aa67-44aa72 IsWindowEnabled 1712->1719 1727 44aaa6-44aaaa 1718->1727 1728 44aaf8-44aaff 1718->1728 1719->1718 1720 44aa74-44aa7e EnableWindow 1719->1720 1720->1718 1731 44aac6-44aac9 1727->1731 1732 44aaac-44aab9 call 44dab9 1727->1732 1729 44ab01-44ab06 EnableWindow 1728->1729 1730 44ab0c-44ab0f 1728->1730 1729->1730 1734 44ab25-44ab33 call 44a9a3 1730->1734 1735 44ab11-44ab1a GetActiveWindow 1730->1735 1731->1728 1733 44aacb-44aadc call 44dbd0 1731->1733 1742 44aabe-44aac1 call 44d4b0 1732->1742 1743 44aabb-44aabd 1732->1743 1733->1728 1734->1713 1735->1734 1738 44ab1c-44ab1f SetActiveWindow 1735->1738 1738->1734 1742->1731 1743->1742
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 0044A9EA
                                                                                          • FindResourceW.KERNEL32(?,00000000,00000005,00000000,?,00000000), ref: 0044AA22
                                                                                          • LoadResource.KERNEL32(?,00000000,?,00000000), ref: 0044AA2A
                                                                                            • Part of subcall function 0044B7AD: UnhookWindowsHookEx.USER32(?), ref: 0044B7D2
                                                                                          • LockResource.KERNEL32(?,00000000,?,00000000), ref: 0044AA37
                                                                                          • IsWindowEnabled.USER32(?), ref: 0044AA6A
                                                                                          • EnableWindow.USER32(?,00000000), ref: 0044AA78
                                                                                          • EnableWindow.USER32(?,00000001), ref: 0044AB06
                                                                                          • GetActiveWindow.USER32 ref: 0044AB11
                                                                                          • SetActiveWindow.USER32(?,?,00000000,?,00000000), ref: 0044AB1F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Resource$ActiveEnable$EnabledFindH_prologHookLoadLockUnhookWindows
                                                                                          • String ID:
                                                                                          • API String ID: 401145483-0
                                                                                          • Opcode ID: 2cda234a6a69b5127656454aafaeed64d8b55198f2d18ad4e9a37003fc768c6f
                                                                                          • Instruction ID: 821eaf548434c4c9b70f773cfe80b396dce7692bbba8f3af9123f63cec625b12
                                                                                          • Opcode Fuzzy Hash: 2cda234a6a69b5127656454aafaeed64d8b55198f2d18ad4e9a37003fc768c6f
                                                                                          • Instruction Fuzzy Hash: 45410330A407049FEB21AF65C949A6FBBB5EF48706F10051FF50172292DB789E10CB5A
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 0044C0E1
                                                                                          • GetVersion.KERNEL32(00000007,?,?,00000000,00000000,?,0000C000,00000000,00000000,00000007), ref: 0044C294
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: H_prologVersion
                                                                                          • String ID:
                                                                                          • API String ID: 1836448879-0
                                                                                          • Opcode ID: 9e90a423b6031cb2ef77fb3055f580af0dc247c90ea7df01da21d9b461274670
                                                                                          • Instruction ID: da9fe6a70777de8376f4fd2caf7e403b704f0216ee8542960886228e35cbf778
                                                                                          • Opcode Fuzzy Hash: 9e90a423b6031cb2ef77fb3055f580af0dc247c90ea7df01da21d9b461274670
                                                                                          • Instruction Fuzzy Hash: A3E1AD70602215ABFB54DF65CCC0ABE77A9FF04304F14851AF806DA292DB78EE11DB69

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 87 402e00-402e5c call 450c43 call 450ba1 92 402e62-402e66 87->92 93 402e5e-402e60 87->93 94 402e69-402e7d CreateCompatibleDC call 450c58 92->94 93->94 97 402e83-402e86 94->97 98 402f0a-402f0e 94->98 101 402ea6-402ea8 97->101 102 402e88-402e8c 97->102 99 402f10-402f15 98->99 100 402f1b-402f1e 98->100 105 402f17-402f19 99->105 106 402f6e 99->106 108 402f20-402f25 100->108 109 402f3c-402f3f 100->109 103 402ec5-402ec8 101->103 104 402eaa-402eaf 101->104 102->101 107 402e8e-402e93 102->107 116 402eca-402ecf 103->116 117 402edc-402ee0 103->117 112 402f55-402f61 104->112 113 402eb5-402ec0 104->113 118 402f71-402f76 105->118 106->118 110 402f31-402f3a 107->110 119 402e99-402ea1 107->119 108->110 111 402f27-402f2f 108->111 114 402f41-402f46 109->114 115 402f63-402f68 109->115 120 402f77-402f9c call 450d99 GetClientRect 110->120 111->120 112->120 113->120 114->112 121 402f48-402f53 114->121 115->106 123 402f6a-402f6c 115->123 116->106 122 402ed5-402ed7 116->122 124 402ee2-402ee7 117->124 125 402ef6-402efb 117->125 118->120 119->120 130 402fa2-402fc7 GetClientRect call 450ba1 120->130 131 403603-403645 BitBlt 120->131 121->120 122->118 123->118 124->110 126 402ee9-402ef1 124->126 125->112 127 402efd-402f08 125->127 126->120 127->120 137 402fc9-402fcb 130->137 138 402fcd-402fd1 130->138 132 40364b-403651 131->132 134 403653 132->134 135 403656-403696 call 450d99 call 450cc0 call 450cd6 132->135 134->135 140 402fd4-403144 CreateCompatibleDC call 450c58 call 403cd0 CreateCompatibleBitmap call 45154f call 450d99 BitBlt GdipCreateStringFormat GdipCreateFontFamilyFromName GdipCreateFont GdipCreateFromHDC 137->140 138->140 154 403146-403149 140->154 155 40316e 140->155 154->155 157 40314b-40314e 154->157 156 403174-403214 call 403d40 GdipCreateSolidFill call 4397b0 GdipSetStringFormatFlags 155->156 166 403216 156->166 167 40321a-403228 GdipSetStringFormatTrimming 156->167 159 403150-403156 157->159 160 403158-40315c 157->160 159->156 162 403166-40316c 160->162 163 40315e-403164 160->163 162->156 163->156 166->167 168 40322a 167->168 169 40322e-40323b GdipSetTextRenderingHint 167->169 168->169 170 403241-403247 169->170 171 40323d 169->171 172 4032e3-4032e6 170->172 173 40324d-4032c4 GdipSetStringFormatAlign 170->173 171->170 174 4032ec-403363 GdipSetStringFormatAlign 172->174 175 40336e-403371 172->175 176 4032c6 173->176 177 4032ca-4032d8 GdipSetStringFormatLineAlign 173->177 174->177 180 403369 174->180 181 403377-4033ee GdipSetStringFormatAlign 175->181 182 403458-403471 GdipSetStringFormatAlign 175->182 176->177 178 403408-403450 GdipDrawString 177->178 179 4032de 177->179 186 403456 178->186 187 4034d9-403530 BitBlt 178->187 183 403404 179->183 180->176 184 4033f0 181->184 185 4033f4-403402 GdipSetStringFormatLineAlign 181->185 188 403473 182->188 189 403477-403485 GdipSetStringFormatLineAlign 182->189 183->178 184->185 185->178 185->183 192 4034d5 186->192 190 403532-403534 187->190 191 403536 187->191 188->189 193 403487 189->193 194 40348b-4034d3 GdipDrawString 189->194 195 403539-403601 call 450d99 call 4515a6 call 450cc0 DeleteObject ReleaseDC DeleteObject * 3 GdipDeleteBrush GdipDeleteGraphics GdipDeleteFont GdipDeleteFontFamily GdipDeleteStringFormat call 4515a6 call 450cd6 190->195 191->195 192->187 193->194 194->187 194->192 195->132
                                                                                          APIs
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00402E6A
                                                                                          • GetClientRect.USER32(?,?), ref: 00402F92
                                                                                          • GetClientRect.USER32(?,?), ref: 00402FAB
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00402FD5
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00403025
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 004030A3
                                                                                          • GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 004030B4
                                                                                          • GdipCreateFontFamilyFromName.GDIPLUS(Arial,00000000,?,00000000,00000000,?), ref: 004030D2
                                                                                          • GdipCreateFont.GDIPLUS(?,?,00000000,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 00403107
                                                                                          • GdipCreateFromHDC.GDIPLUS(?,?,?,?,00000000,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 00403129
                                                                                          • GdipCreateSolidFill.GDIPLUS(?,?,00000006,?,?,?,?,00000000,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0040319A
                                                                                          • GdipSetStringFormatFlags.GDIPLUS(?,00001000), ref: 0040320D
                                                                                          • GdipSetStringFormatTrimming.GDIPLUS(?,00000004,?,00001000), ref: 00403221
                                                                                          • GdipSetTextRenderingHint.GDIPLUS(?,00000000,?,00000004,?,00001000), ref: 00403234
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000,?,00000000,?,00000004,?,00001000), ref: 004032BD
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(00000000,00000001,?,00000000,?,00000000,?,00000004,?,00001000), ref: 004032D1
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000,?,00000000,?,00000004,?,00001000), ref: 0040335C
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000,?,00000000,?,00000004,?,00001000), ref: 004033E7
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(00000000,00000001,?,00000000,?,00000000,?,00000004,?,00001000), ref: 004033FB
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,00000000,?,00000000,00000001,?,00000000,?,00000000,?,00000004,?), ref: 00403449
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000001,?,00000000,?,00000004,?,00001000), ref: 0040346A
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(00000000,00000001,?,00000001,?,00000000,?,00000004,?,00001000), ref: 0040347E
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,00000000,?,00000000,00000001,?,00000001,?,00000000,?,00000004,?), ref: 004034CC
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00403521
                                                                                          • DeleteObject.GDI32(?), ref: 0040356A
                                                                                          • ReleaseDC.USER32(?,?), ref: 00403578
                                                                                          • DeleteObject.GDI32(?), ref: 00403583
                                                                                          • DeleteObject.GDI32(?), ref: 0040358D
                                                                                          • DeleteObject.GDI32(?), ref: 00403594
                                                                                          • GdipDeleteBrush.GDIPLUS(?), ref: 0040359F
                                                                                          • GdipDeleteGraphics.GDIPLUS(?,?), ref: 004035A9
                                                                                          • GdipDeleteFont.GDIPLUS(?,?,?), ref: 004035B3
                                                                                          • GdipDeleteFontFamily.GDIPLUS(?,?,?,?), ref: 004035C0
                                                                                          • GdipDeleteStringFormat.GDIPLUS(?,?,?,?,?), ref: 004035CA
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00403645
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Gdip$String$Format$Delete$Create$Align$FontObject$CompatibleLine$ClientDrawFamilyFromRect$BitmapBrushFillFlagsGraphicsHintNameReleaseRenderingSolidTextTrimming
                                                                                          • String ID: Arial$`=@$hE
                                                                                          • API String ID: 1158441791-2905065322
                                                                                          • Opcode ID: 1e8d069f00bf8007eac3d1efd034c04e109e6a9d88059bb3d68e46783d5acfbf
                                                                                          • Instruction ID: 886edbfad9c9c99d32574e70476e75f3d523160696c768c3d3fab5b71375a1a3
                                                                                          • Opcode Fuzzy Hash: 1e8d069f00bf8007eac3d1efd034c04e109e6a9d88059bb3d68e46783d5acfbf
                                                                                          • Instruction Fuzzy Hash: EB4249B5208341DFD724DF65C984A6BBBE9BBC8304F108E2EF59993290D774E909CB16

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 206 40b230-40c9f2 call 44e565 * 2 call 44e796 call 419b60 call 44e565 * 3 call 419bd0 call 44e565 * 3 call 419bd0 call 44e565 * 3 call 419bd0 call 44e565 * 3 call 419bd0 call 44e565 * 3 call 419bd0 call 44e730 call 419a70 call 44e4f1 call 44e730 call 419a70 call 44e4f1 call 44e730 call 419a70 call 44e4f1 call 44e730 call 419a70 call 44e4f1 call 44e730 call 419a70 call 44e4f1 call 44e730 call 419a70 call 44e4f1 call 44db8f call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 LoadStringW call 44e565 call 403bf0 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 LoadStringW call 44e565 call 403bf0 721 40c9f8-40caf2 call 448c87 call 44e565 call 44e25e call 44e565 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 44b8d5 call 44e565 call 42e3a0 206->721 745 40caf8-40cb00 721->745 746 40cb06-40cc69 call 448c87 call 44e565 call 44e25e call 44e565 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 44e565 call 403940 call 44e4f1 745->746 775 40cc6f-40d6ea call 448c87 call 44e565 call 44e25e call 44e565 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 44e565 call 403940 call 44e4f1 call 448c87 call 44e565 call 44e25e call 44e565 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 44e565 call 403940 call 44e4f1 call 44e5ba call 44e730 call 44e638 call 44e4f1 * 2 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 407df0 call 408200 call 407d90 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 407df0 call 408200 call 407d90 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 407df0 call 408200 call 407d90 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 LoadStringW call 44e565 call 403bf0 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 LoadStringW call 44e565 call 403bf0 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 44e5ba call 44e730 call 4028a0 call 44e4f1 call 402580 call 44e565 call 402900 746->775 1002 40d6f0-40d840 call 448c87 call 44e565 call 44e25e call 44e565 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 44e565 call 403940 call 44e4f1 775->1002 1031 40d846-40df6f call 44e5ba * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 44e565 call 403940 call 44e4f1 call 44e5ba * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 44e565 call 403940 call 44e4f1 call 44e5ba * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 LoadStringW call 44e565 call 403bf0 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 44e565 * 3 call 419bd0 call 44e638 call 44e4f1 call 44e25e call 422e20 call 45277e 1002->1031 1187 40df74-40e133 call 403a00 call 4039e0 call 44e565 call 403940 call 44e4f1 call 4515a6 * 4 call 44e4f1 * 11 call 4515a6 * 4 1031->1187 1235 40e138-40e155 1187->1235
                                                                                          APIs
                                                                                            • Part of subcall function 0044E565: lstrlenW.KERNEL32(?,?,?,?,004506A0,?,?), ref: 0044E58F
                                                                                            • Part of subcall function 0044E796: __EH_prolog.LIBCMT ref: 0044E79B
                                                                                            • Part of subcall function 00419BD0: GetPrivateProfileStringW.KERNEL32 ref: 00419C28
                                                                                            • Part of subcall function 0044E730: __EH_prolog.LIBCMT ref: 0044E735
                                                                                            • Part of subcall function 00419A70: CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00419A8A
                                                                                            • Part of subcall function 00419A70: GetFileSize.KERNEL32(00000000,00000000), ref: 00419A95
                                                                                            • Part of subcall function 00419A70: GlobalAlloc.KERNELBASE(00000002,00000000), ref: 00419AA0
                                                                                            • Part of subcall function 00419A70: GlobalLock.KERNEL32(00000000), ref: 00419AA9
                                                                                            • Part of subcall function 00419A70: ReadFile.KERNELBASE ref: 00419AC1
                                                                                            • Part of subcall function 00419A70: GlobalUnlock.KERNEL32(00000000), ref: 00419AC8
                                                                                            • Part of subcall function 00419A70: CloseHandle.KERNELBASE(00000000), ref: 00419ACF
                                                                                            • Part of subcall function 00419A70: CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00419AE5
                                                                                            • Part of subcall function 00419A70: #251.OLEPRO32(00000000,00000000,00000000,00464918,00000000), ref: 00419AFD
                                                                                            • Part of subcall function 00419A70: GetObjectW.GDI32(?,00000018,00000000), ref: 00419B3E
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                            • Part of subcall function 0044DB8F: MoveWindow.USER32(?,?,?,00000000,?,?,?,00435AE2,?,?,?,?,00000000), ref: 0044DBAB
                                                                                            • Part of subcall function 0044E25E: InterlockedIncrement.KERNEL32(?), ref: 0044E273
                                                                                            • Part of subcall function 00403A00: GetDC.USER32(?), ref: 00403A46
                                                                                            • Part of subcall function 00403A00: ReleaseDC.USER32(?,?), ref: 00403B13
                                                                                            • Part of subcall function 004039E0: InvalidateRect.USER32(?,00000000,00000001,0040172E,?), ref: 004039F6
                                                                                            • Part of subcall function 00403940: SendMessageW.USER32(?,0000040D,00000000,00000000), ref: 00403971
                                                                                            • Part of subcall function 00403940: GetClientRect.USER32(?,?), ref: 00403980
                                                                                            • Part of subcall function 00403940: SendMessageW.USER32(?,00000401,?,00000000), ref: 004039BA
                                                                                            • Part of subcall function 0044E638: InterlockedIncrement.KERNEL32(-000000F4), ref: 0044E67B
                                                                                          • LoadStringW.USER32(10000000,0000000C,?,00000104), ref: 0040C83D
                                                                                          • LoadStringW.USER32(10000000,0000000B,?,00000104), ref: 0040C9B7
                                                                                            • Part of subcall function 0044E5BA: lstrlenA.KERNEL32(?,00000000,?,00000000,0043649B,0000001C), ref: 0044E5CF
                                                                                            • Part of subcall function 00407DF0: GetModuleHandleW.KERNEL32(00000000,?,00000000,00000000,00000000,00002010), ref: 00407E4E
                                                                                            • Part of subcall function 00407DF0: LoadImageW.USER32(00000000), ref: 00407E55
                                                                                            • Part of subcall function 00408200: InvalidateRect.USER32(?,00000000,00000001,?,?,00402128,00000000,?,?,?,?,scroll_arrow_down.bmp), ref: 00408218
                                                                                            • Part of subcall function 00407D90: GetDC.USER32(?), ref: 00407D98
                                                                                            • Part of subcall function 00407D90: ReleaseDC.USER32(?,?), ref: 00407DE0
                                                                                            • Part of subcall function 00407DF0: GetObjectW.GDI32(00000000,00000018,?), ref: 00407E99
                                                                                          • LoadStringW.USER32(10000000,00000002,?,00000104), ref: 0040D43F
                                                                                          • LoadStringW.USER32(10000000,0000000A,?,00000104), ref: 0040D5B7
                                                                                          • LoadStringW.USER32(10000000,00000001,?,00000104), ref: 0040DD47
                                                                                            • Part of subcall function 004515A6: DeleteObject.GDI32(00000000), ref: 004515B5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LoadString$Global$FileInterlockedObjectRect$CreateH_prologHandleIncrementInvalidateMessageReleaseSendlstrlen$#251AllocClientCloseDecrementDeleteImageLockModuleMovePrivateProfileReadSizeStreamUnlockWindow
                                                                                          • String ID: BUTTONPOS$BUTTONPOS$C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\$C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\skins\$Disable$Down$Mask$Normal$Over$SCREEN$Y$hE$i$i$scroll.bmp$skin_main.ini$skins\double_click.avi$w$}
                                                                                          • API String ID: 2843815645-2387724563
                                                                                          • Opcode ID: df15f11056632f04bf706d5151e442022ba7bc0493e0f9dfe22270b6b0994165
                                                                                          • Instruction ID: eff2aea92b570ebcab23e2350375e75ee21f4ce84da65f5004bc5a409a8c0c33
                                                                                          • Opcode Fuzzy Hash: df15f11056632f04bf706d5151e442022ba7bc0493e0f9dfe22270b6b0994165
                                                                                          • Instruction Fuzzy Hash: 05535170508381AFD624EF66C451BAFBBD9AFD9708F044D0EF08953281DB796509CBAB

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1237 44d15c-44d177 call 44dab9 1240 44d17e-44d182 1237->1240 1241 44d179-44d17c 1237->1241 1243 44d184-44d18d GetParent 1240->1243 1244 44d18f-44d194 GetWindow 1240->1244 1242 44d1b6-44d1c9 GetWindowRect 1241->1242 1246 44d1cf-44d1d1 1242->1246 1247 44d25a-44d281 GetParent GetClientRect * 2 MapWindowPoints 1242->1247 1245 44d19a-44d19e 1243->1245 1244->1245 1245->1242 1248 44d1a0-44d1b2 SendMessageW 1245->1248 1249 44d1d3-44d1e1 GetWindowLongW 1246->1249 1250 44d1ec-44d1f5 1246->1250 1251 44d287-44d2c6 1247->1251 1248->1242 1252 44d1b4 1248->1252 1253 44d1e3-44d1e8 1249->1253 1254 44d1ea 1249->1254 1255 44d1f7-44d1fe call 431650 1250->1255 1256 44d231-44d258 GetWindowRect call 431941 call 4319ac CopyRect 1250->1256 1257 44d2cd-44d2d4 1251->1257 1258 44d2c8-44d2cb 1251->1258 1252->1242 1253->1250 1253->1254 1254->1250 1270 44d200 1255->1270 1271 44d203-44d22f call 431941 call 4319ac CopyRect * 2 1255->1271 1256->1251 1261 44d2de-44d2e1 1257->1261 1262 44d2d6-44d2dc 1257->1262 1258->1261 1263 44d2e3-44d2e6 1261->1263 1264 44d2e8-44d2ed 1261->1264 1262->1261 1267 44d2f8-44d305 call 44dbd0 1263->1267 1264->1267 1268 44d2ef-44d2f5 1264->1268 1276 44d30a-44d30e 1267->1276 1268->1267 1270->1271 1271->1251
                                                                                          APIs
                                                                                            • Part of subcall function 0044DAB9: GetWindowLongW.USER32(?,000000F0), ref: 0044DAC5
                                                                                          • GetParent.USER32(?), ref: 0044D187
                                                                                          • SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 0044D1AA
                                                                                          • GetWindowRect.USER32(?,?), ref: 0044D1C3
                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 0044D1D6
                                                                                          • CopyRect.USER32(?,?), ref: 0044D223
                                                                                          • CopyRect.USER32(?,?), ref: 0044D22D
                                                                                          • GetWindowRect.USER32(00000000,?), ref: 0044D236
                                                                                            • Part of subcall function 00431941: MonitorFromWindow.USER32(?,?), ref: 00431956
                                                                                            • Part of subcall function 004319AC: GetMonitorInfoW.USER32(?,?), ref: 004319C3
                                                                                          • CopyRect.USER32(?,?), ref: 0044D252
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: RectWindow$Copy$LongMonitor$FromInfoMessageParentSend
                                                                                          • String ID: ($@
                                                                                          • API String ID: 1450647913-1311469180
                                                                                          • Opcode ID: a364a76fa4976e313cf8c07487e596a4b2389bace159fbd1c2919fb6209ddcb7
                                                                                          • Instruction ID: 7408d5a86c2df288ccef5a3e9a24fbc155bb31072f3ca8ed33858427e68f6f47
                                                                                          • Opcode Fuzzy Hash: a364a76fa4976e313cf8c07487e596a4b2389bace159fbd1c2919fb6209ddcb7
                                                                                          • Instruction Fuzzy Hash: 00518171E00209AFEB14DBA9CC85EEEBBB9AF44314F144166F901F3291DA74E9058B58

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1279 44b5bd-44b5dc call 453fe7 1282 44b5f5-44b613 call 453485 1279->1282 1283 44b5de-44b5f0 CallNextHookEx 1279->1283 1287 44b6ad-44b6d0 call 44b346 1282->1287 1288 44b619-44b620 1282->1288 1284 44b6a8-44b6aa 1283->1284 1303 44b745-44b758 call 44b3dc SetWindowLongW 1287->1303 1304 44b6d2-44b6d6 1287->1304 1290 44b680-44b695 CallNextHookEx 1288->1290 1291 44b622-44b624 1288->1291 1292 44b6a4-44b6a7 1290->1292 1293 44b697-44b6a0 UnhookWindowsHookEx 1290->1293 1291->1290 1295 44b626-44b634 GetWindowLongW 1291->1295 1292->1284 1293->1292 1295->1290 1296 44b636-44b645 GetPropW 1295->1296 1296->1290 1298 44b647-44b65d SetPropW GetPropW 1296->1298 1298->1290 1299 44b65f-44b66f GlobalAddAtomW 1298->1299 1300 44b676-44b67a SetWindowLongW 1299->1300 1301 44b671 1299->1301 1300->1290 1301->1300 1310 44b739-44b73d 1303->1310 1311 44b75a-44b75f 1303->1311 1304->1303 1306 44b6d8-44b6e0 1304->1306 1307 44b742 1306->1307 1308 44b6e2-44b6e6 1306->1308 1307->1303 1308->1307 1312 44b6e8-44b6fd call 44b140 1308->1312 1310->1290 1311->1310 1312->1307 1315 44b6ff-44b723 call 44b3dc GetWindowLongW 1312->1315 1319 44b725-44b734 SetWindowLongW 1315->1319 1320 44b736 1315->1320 1319->1320 1320->1310
                                                                                          APIs
                                                                                            • Part of subcall function 00453FE7: TlsGetValue.KERNEL32(00498528,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36,?,00000000,?,0044869C,00000000,00000000,00000000,00000000), ref: 00454026
                                                                                          • CallNextHookEx.USER32(?,00000003,?,?), ref: 0044B5EA
                                                                                          • GetWindowLongW.USER32(?,000000FC), ref: 0044B629
                                                                                          • GetPropW.USER32(?,AfxOldWndProc423), ref: 0044B63D
                                                                                          • SetPropW.USER32(?,AfxOldWndProc423,00000003), ref: 0044B64C
                                                                                          • GetPropW.USER32(?,AfxOldWndProc423), ref: 0044B654
                                                                                          • GlobalAddAtomW.KERNEL32(AfxOldWndProc423), ref: 0044B660
                                                                                          • SetWindowLongW.USER32(?,000000FC,Function_0004B541), ref: 0044B67A
                                                                                          • CallNextHookEx.USER32(?,00000003,?,?), ref: 0044B689
                                                                                          • UnhookWindowsHookEx.USER32(?), ref: 0044B69A
                                                                                          • GetWindowLongW.USER32(?,000000FC), ref: 0044B70A
                                                                                          • SetWindowLongW.USER32(?,000000FC,00000000), ref: 0044B72B
                                                                                          • SetWindowLongW.USER32(?,000000FC,00000000), ref: 0044B750
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LongWindow$HookProp$CallNext$AtomGlobalUnhookValueWindows
                                                                                          • String ID: AfxOldWndProc423
                                                                                          • API String ID: 3289694481-1060338832
                                                                                          • Opcode ID: c5e29bf94405e57d78d6ce035f7fb68d19d65453b4323946ba77e8b2ffa353e9
                                                                                          • Instruction ID: fc84507ded395432fa802afeec13034d02ebd91946f274bc15145c2185046274
                                                                                          • Opcode Fuzzy Hash: c5e29bf94405e57d78d6ce035f7fb68d19d65453b4323946ba77e8b2ffa353e9
                                                                                          • Instruction Fuzzy Hash: 6D519F31500214BFDF119F65DC88B6E3FB4EF46766F11816AF9059A292DB38CA00DBD9

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1321 424700-424737 call 4397b0 call 422fc0 1326 424745-4247fa call 423000 call 439d30 call 423000 call 439d30 call 423000 call 439d30 call 423000 call 439d30 call 423000 call 439d30 1321->1326 1327 424739-424744 1321->1327 1348 4247ff-424802 1326->1348 1349 424813-42481d 1348->1349 1350 424804-424806 1348->1350 1349->1348 1352 42481f-42482d 1349->1352 1350->1349 1351 424808-42480b 1350->1351 1351->1349 1353 42480d 1351->1353 1354 42483b 1352->1354 1355 42482f-424839 1352->1355 1353->1349 1356 424841-42485d RegCloseKey call 422fc0 1354->1356 1355->1356 1358 424862-424867 1356->1358 1359 424876-42489a call 423000 call 439d30 1358->1359 1360 424869-424875 1358->1360 1365 4248bf-4248e1 RegCloseKey 1359->1365 1366 42489c-4248be RegCloseKey 1359->1366
                                                                                          APIs
                                                                                            • Part of subcall function 00422FC0: RegOpenKeyExW.KERNELBASE(004856F0,?,00000000,000F003F,?,00474CF0,004856F0,?,00424732,80000001,?,?,?,Control Panel\Mouse,00474CF0,004856F0), ref: 00422FD9
                                                                                            • Part of subcall function 00422FC0: RegCreateKeyW.ADVAPI32(004856F0,?,?), ref: 00422FEA
                                                                                          • RegCloseKey.KERNELBASE(?), ref: 0042484C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateOpen
                                                                                          • String ID: Control Panel\Desktop$Control Panel\Mouse$DoubleClickSpeed$MouseSensitivity$MouseSpeed$MouseThreshold1$MouseThreshold2$WheelScrollLines
                                                                                          • API String ID: 199004384-4240905876
                                                                                          • Opcode ID: 7d0a40ed77b534547ad7234ce58cf159cf1f32e1d3bd9f733192194a4c191746
                                                                                          • Instruction ID: 93b794c766409c7faec2fe229297b7fb32aea169ecdef794c01004a8ebe250ac
                                                                                          • Opcode Fuzzy Hash: 7d0a40ed77b534547ad7234ce58cf159cf1f32e1d3bd9f733192194a4c191746
                                                                                          • Instruction Fuzzy Hash: BC41A5B56143006ED320EB65DC81FAFB3A8EBC4319F908D1FF99982241D67DE505CBA6

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • CreateMutexW.KERNELBASE(00000000,00000000,SI-998_Gaming_Mouse_Normal_configure,?,?,?,004578EB,000000FF), ref: 0040865C
                                                                                          • GetLastError.KERNEL32(?,?,?,004578EB,000000FF), ref: 00408668
                                                                                          • CloseHandle.KERNEL32(?,?,?,?,004578EB,000000FF), ref: 0040867C
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004086BA
                                                                                          • GdiplusStartup.GDIPLUS ref: 00408747
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateErrorFileGdiplusHandleLastModuleMutexNameStartup
                                                                                          • String ID: #$*$C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\$SI-998_Gaming_Mouse_Normal_configure$hE
                                                                                          • API String ID: 1380881251-1912759234
                                                                                          • Opcode ID: 1a5a5718e92993641ce1dcbae2d9538c6b3e13410a90fd3dc353c36c313215c1
                                                                                          • Instruction ID: fa6b2c5f85d514f8399ba1dbc5ce7d2fd13781f99fa12fb491e5cfd2257eba37
                                                                                          • Opcode Fuzzy Hash: 1a5a5718e92993641ce1dcbae2d9538c6b3e13410a90fd3dc353c36c313215c1
                                                                                          • Instruction Fuzzy Hash: 85C1F43400C3C099E735E766C959BDEBBE8AF99304F44491EE4D9522C2DBB85208CFA7

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1472 44a6f6-44a713 call 439e18 1475 44a715-44a71d call 453485 1472->1475 1476 44a720-44a74a call 453485 call 44d6f2 * 2 1472->1476 1475->1476 1485 44a773-44a776 1476->1485 1486 44a74c-44a75c 1476->1486 1487 44a77c-44a7a9 call 44ffb0 1485->1487 1488 44a90b-44a90d 1485->1488 1486->1488 1492 44a762-44a770 1486->1492 1494 44a7fe-44a832 call 44fdff call 45010f call 44fe9c call 44fe8e 1487->1494 1495 44a7ab-44a7b5 GetSystemMetrics 1487->1495 1491 44a912-44a920 1488->1491 1492->1485 1498 44a840-44a853 call 44b761 1494->1498 1527 44a834-44a83d GlobalLock 1494->1527 1495->1498 1499 44a7bb-44a7cc call 439a55 1495->1499 1506 44a855-44a857 1498->1506 1507 44a859 1498->1507 1509 44a7f4-44a7f9 1499->1509 1510 44a7ce-44a7df call 439a55 1499->1510 1511 44a85c-44a878 CreateDialogIndirectParamW call 44e4f1 1506->1511 1507->1511 1509->1494 1512 44a7fb 1509->1512 1510->1509 1520 44a7e1-44a7f2 call 439a55 1510->1520 1518 44a87d-44a8a2 1511->1518 1512->1494 1525 44a8a4-44a8b2 1518->1525 1526 44a8bf-44a8c6 call 44b7ad 1518->1526 1520->1498 1520->1509 1525->1526 1531 44a8b4-44a8b7 1525->1531 1532 44a8d2-44a8d5 1526->1532 1533 44a8c8-44a8ca 1526->1533 1527->1498 1531->1526 1534 44a8d7-44a8db 1532->1534 1535 44a8e9-44a8ec 1532->1535 1533->1532 1534->1535 1536 44a8dd-44a8e6 DestroyWindow 1534->1536 1537 44a900-44a903 1535->1537 1538 44a8ee-44a8fa GlobalUnlock GlobalFree 1535->1538 1536->1535 1539 44a905-44a909 1537->1539 1540 44a90f-44a911 1537->1540 1538->1537 1539->1488 1539->1540 1540->1491
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 0044A6FB
                                                                                          • GetSystemMetrics.USER32(0000002A), ref: 0044A7AD
                                                                                          • GlobalLock.KERNEL32(?), ref: 0044A837
                                                                                          • CreateDialogIndirectParamW.USER32(?,?,?,Function_0004A53E,00000000), ref: 0044A869
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          • DestroyWindow.USER32(?,?,?,00000000,?,?), ref: 0044A8E0
                                                                                          • GlobalUnlock.KERNEL32(?), ref: 0044A8F1
                                                                                          • GlobalFree.KERNEL32(?), ref: 0044A8FA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$CreateDecrementDestroyDialogFreeH_prologIndirectInterlockedLockMetricsParamSystemUnlockWindow
                                                                                          • String ID: Helv$MS Sans Serif$MS Shell Dlg
                                                                                          • API String ID: 2343056566-2894235370
                                                                                          • Opcode ID: d502266635f6ca199efce9f172131b612870d0e90b6c8c8ca27d85a3fb8e84bf
                                                                                          • Instruction ID: f8f37d4c82a8f54d432c8b840bed90ec2bd5214203f1057a2b579b2c25036d77
                                                                                          • Opcode Fuzzy Hash: d502266635f6ca199efce9f172131b612870d0e90b6c8c8ca27d85a3fb8e84bf
                                                                                          • Instruction Fuzzy Hash: 7761817194020ADFEF14EFA5C8859AEBBB1FF04305F24442FF405A22A2D7789E55CB5A

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1541 4223b0-42244d call 4512a7 call 450ba1 call 403cd0 * 2 GetWindowRect CreateCompatibleDC call 450c58 1552 422452-4224b1 call 450d99 CreateRectRgn call 45154f GetPixel 1541->1552 1553 42244f 1541->1553 1558 4224b7-4224c1 1552->1558 1559 42254c-42254f 1552->1559 1553->1552 1562 4224c5-4224cd 1558->1562 1560 422551-42255a call 450d99 1559->1560 1561 42255f-42258c SetWindowRgn call 4515a6 1559->1561 1560->1561 1567 422591-4225d3 call 4515a6 call 450cd6 call 451319 1561->1567 1565 422535-422542 1562->1565 1566 4224cf-4224e0 GetPixel 1562->1566 1565->1562 1570 422544-422548 1565->1570 1568 4224e2-42251f CreateRectRgn call 45154f CombineRgn call 4515a6 1566->1568 1569 422524-422533 1566->1569 1568->1569 1569->1565 1569->1566 1570->1559
                                                                                          APIs
                                                                                            • Part of subcall function 004512A7: __EH_prolog.LIBCMT ref: 004512AC
                                                                                            • Part of subcall function 004512A7: GetDC.USER32(00000001), ref: 004512D5
                                                                                          • GetWindowRect.USER32(?,?), ref: 00422423
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00422438
                                                                                          • CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00422484
                                                                                          • GetPixel.GDI32(?,00000000,00000000), ref: 00422499
                                                                                          • GetPixel.GDI32(?,00000000,00000000), ref: 004224D6
                                                                                          • CreateRectRgn.GDI32(00000000,00000000,00000001,00000001), ref: 004224EC
                                                                                          • CombineRgn.GDI32(?,?,?,00000003), ref: 00422519
                                                                                          • SetWindowRgn.USER32(?,?,00000001), ref: 00422574
                                                                                            • Part of subcall function 004515A6: DeleteObject.GDI32(00000000), ref: 004515B5
                                                                                            • Part of subcall function 00450CD6: __EH_prolog.LIBCMT ref: 00450CDB
                                                                                            • Part of subcall function 00450CD6: DeleteDC.GDI32(00000000), ref: 00450CFA
                                                                                            • Part of subcall function 00451319: __EH_prolog.LIBCMT ref: 0045131E
                                                                                            • Part of subcall function 00451319: ReleaseDC.USER32(?,00000000), ref: 0045133D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateH_prologRect$DeletePixelWindow$CombineCompatibleObjectRelease
                                                                                          • String ID: ,&F
                                                                                          • API String ID: 697504870-2457272599
                                                                                          • Opcode ID: 11e7beeec1bc272d466dc57fbcd7874503b0fbd82a2883d683128581d58be786
                                                                                          • Instruction ID: b511ad2f3443a8aa8bfe18718bfdc123de76c7a6922b2669bf85fd4e07074871
                                                                                          • Opcode Fuzzy Hash: 11e7beeec1bc272d466dc57fbcd7874503b0fbd82a2883d683128581d58be786
                                                                                          • Instruction Fuzzy Hash: AC61A075208351AFC304DF65C985E6BBBE9FBC8705F004A1DF88683291DB78E908CB56

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • SendMessageW.USER32(?,00000080,00000001,?), ref: 00409CD7
                                                                                          • SendMessageW.USER32(?,00000080,00000000,?), ref: 00409CE7
                                                                                          • OpenMutexW.KERNEL32(001F0001,00000000,SI-998-ShareData-Mutex-Object), ref: 00409D22
                                                                                          • LoadStringW.USER32(10000000,000003E8,?,00000104), ref: 00409E66
                                                                                          • LoadStringW.USER32(10000000,000003E9,?,00000104), ref: 00409E8D
                                                                                            • Part of subcall function 0044E6AF: lstrlenA.KERNEL32(004321DF,?,?,?,004321DF,?), ref: 0044E6BD
                                                                                            • Part of subcall function 0040E790: WaitForSingleObject.KERNEL32(?,000000FF,75C05540,?,00409DBF,004856F0,1.04,?,N/A), ref: 0040E79F
                                                                                            • Part of subcall function 0040E790: ReleaseMutex.KERNEL32(?,00000000,?,00409DBF,004856F0,1.04,?,N/A), ref: 0040E7C2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LoadMessageMutexSendString$ObjectOpenReleaseSingleWaitlstrlen
                                                                                          • String ID: 1.04$MOSUE DRIVER V628M$N/A$SI-998-ShareData-Mutex-Object
                                                                                          • API String ID: 108540399-1450306218
                                                                                          • Opcode ID: 205c6fa47214ac46e4f0ccaca2ebf8b5238217eaaa864a81e04d5a7d53ffbb4c
                                                                                          • Instruction ID: 63763cd9265bdd9854de161677ec2cfc6eca48a926ccac9495dfb173b33aad12
                                                                                          • Opcode Fuzzy Hash: 205c6fa47214ac46e4f0ccaca2ebf8b5238217eaaa864a81e04d5a7d53ffbb4c
                                                                                          • Instruction Fuzzy Hash: AC51C8716806006BEB14BF529C92FAA33149B90718F41443FFD066B1D7DEBDA90587AD

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1647 44b3e2-44b419 call 439e18 GetPropW 1650 44b4cc-44b4e1 call 44b301 * 2 call 44b069 1647->1650 1651 44b41f-44b422 1647->1651 1670 44b4e6-44b4e8 1650->1670 1653 44b428-44b42b 1651->1653 1654 44b4ab-44b4ca call 44b301 call 44b0ca 1651->1654 1656 44b487-44b4a9 SetWindowLongW RemovePropW GlobalFindAtomW GlobalDeleteAtom 1653->1656 1657 44b42d-44b432 1653->1657 1654->1670 1661 44b4ea-44b500 CallWindowProcW 1656->1661 1660 44b438-44b46e call 44b301 call 44afcd CallWindowProcW call 44aff0 1657->1660 1657->1661 1665 44b473-44b484 1660->1665 1661->1665 1670->1661 1670->1665
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 0044B3E7
                                                                                          • GetPropW.USER32(?,AfxOldWndProc423), ref: 0044B3FF
                                                                                          • CallWindowProcW.USER32(?,?,00000110,?,00000000), ref: 0044B45D
                                                                                            • Part of subcall function 0044AFF0: GetWindowRect.USER32(?,?), ref: 0044B015
                                                                                            • Part of subcall function 0044AFF0: GetWindow.USER32(?,00000004), ref: 0044B032
                                                                                          • SetWindowLongW.USER32(?,000000FC,?), ref: 0044B48D
                                                                                          • RemovePropW.USER32(?,AfxOldWndProc423), ref: 0044B495
                                                                                          • GlobalFindAtomW.KERNEL32(AfxOldWndProc423), ref: 0044B49C
                                                                                          • GlobalDeleteAtom.KERNEL32(00000000), ref: 0044B4A3
                                                                                            • Part of subcall function 0044AFCD: GetWindowRect.USER32(?,?), ref: 0044AFD9
                                                                                          • CallWindowProcW.USER32(?,?,?,?,00000000), ref: 0044B4F7
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
                                                                                          • String ID: AfxOldWndProc423
                                                                                          • API String ID: 2397448395-1060338832
                                                                                          • Opcode ID: 9be4e2229f0125812e397f86959371877aae8fdbc3b285b0f68fa481db112f4b
                                                                                          • Instruction ID: 0cdaa1beddaeadc3a3dd919ed3346c60d6515d7feb11dd3b708a3c59bd94ec64
                                                                                          • Opcode Fuzzy Hash: 9be4e2229f0125812e397f86959371877aae8fdbc3b285b0f68fa481db112f4b
                                                                                          • Instruction Fuzzy Hash: C631417280020AABEF15AFA6DD49DBF7B79FF05315F00412AF901A1152C739CA11DBA9

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1674 453c80-453c9d EnterCriticalSection 1675 453cac-453cb1 1674->1675 1676 453c9f-453ca6 1674->1676 1678 453cb3-453cb6 1675->1678 1679 453cce-453cd7 1675->1679 1676->1675 1677 453d65-453d68 1676->1677 1680 453d70-453d91 LeaveCriticalSection 1677->1680 1681 453d6a-453d6d 1677->1681 1682 453cb9-453cbc 1678->1682 1683 453cec-453d08 GlobalHandle GlobalUnlock GlobalReAlloc 1679->1683 1684 453cd9-453cea GlobalAlloc 1679->1684 1681->1680 1685 453cc6-453cc8 1682->1685 1686 453cbe-453cc4 1682->1686 1687 453d0e-453d1a 1683->1687 1684->1687 1685->1677 1685->1679 1686->1682 1686->1685 1688 453d37-453d64 GlobalLock call 439dc0 1687->1688 1689 453d1c-453d32 GlobalHandle GlobalLock LeaveCriticalSection call 449405 1687->1689 1688->1677 1689->1688
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(00498544,004982A4,00000000,?,00498528,00498528,0045401B,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36,?,00000000), ref: 00453C8F
                                                                                          • GlobalAlloc.KERNELBASE(00002002,00000000,?,?,00498528,00498528,0045401B,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36,?,00000000), ref: 00453CE4
                                                                                          • GlobalHandle.KERNEL32(007224C8), ref: 00453CED
                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00453CF6
                                                                                          • GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 00453D08
                                                                                          • GlobalHandle.KERNEL32(007224C8), ref: 00453D1F
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00453D26
                                                                                          • LeaveCriticalSection.KERNEL32(0043917B,?,?,00498528,00498528,0045401B,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36,?,00000000), ref: 00453D2C
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00453D3B
                                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 00453D84
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
                                                                                          • String ID:
                                                                                          • API String ID: 2667261700-0
                                                                                          • Opcode ID: 5d57e3141b89f5e42b5812040d14feaf9c6971e0e67a1181daaa680fbe2c5aaa
                                                                                          • Instruction ID: 00529c4718519a935f0633af79df9cf91cd2a34e6ace7aea5c79abf38f8b5777
                                                                                          • Opcode Fuzzy Hash: 5d57e3141b89f5e42b5812040d14feaf9c6971e0e67a1181daaa680fbe2c5aaa
                                                                                          • Instruction Fuzzy Hash: FF3181712007099FD7249F29DC89A2AB7F9FB44347F00496EF852C3662E775EA08CB14

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00419A8A
                                                                                          • GetFileSize.KERNEL32(00000000,00000000), ref: 00419A95
                                                                                          • GlobalAlloc.KERNELBASE(00000002,00000000), ref: 00419AA0
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00419AA9
                                                                                          • ReadFile.KERNELBASE ref: 00419AC1
                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00419AC8
                                                                                          • CloseHandle.KERNELBASE(00000000), ref: 00419ACF
                                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00419AE5
                                                                                          • #251.OLEPRO32(00000000,00000000,00000000,00464918,00000000), ref: 00419AFD
                                                                                          • GetObjectW.GDI32(?,00000018,00000000), ref: 00419B3E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$File$Create$#251AllocCloseHandleLockObjectReadSizeStreamUnlock
                                                                                          • String ID:
                                                                                          • API String ID: 1044161604-0
                                                                                          • Opcode ID: c5af31b75831bfb6c2c3da162fc0b2165ae2b1bd4150ed60eaba585ed9517517
                                                                                          • Instruction ID: 4e8c401e489ed974d622bf0d986c1ae232fd9fb42b17a368a031e87fc90bd29a
                                                                                          • Opcode Fuzzy Hash: c5af31b75831bfb6c2c3da162fc0b2165ae2b1bd4150ed60eaba585ed9517517
                                                                                          • Instruction Fuzzy Hash: 79215C74204301AFE218DF21DC89F2B7BA8EBC8712F10485CF94697292D674E905CB6A

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 00422169
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00422184
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004221BA
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 004221E7
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042223B
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00422266
                                                                                            • Part of subcall function 00450CD6: __EH_prolog.LIBCMT ref: 00450CDB
                                                                                            • Part of subcall function 00450CD6: DeleteDC.GDI32(00000000), ref: 00450CFA
                                                                                            • Part of subcall function 00451481: __EH_prolog.LIBCMT ref: 00451486
                                                                                            • Part of subcall function 00451481: EndPaint.USER32(?,?,00000000,?,00401171,?,00000000), ref: 004514A3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CompatibleCreateH_prolog$Paint$BeginBitmapClientDeleteRect
                                                                                          • String ID: hE
                                                                                          • API String ID: 3784590206-2023966264
                                                                                          • Opcode ID: 8593e68492e625a236a0775e4afd030aa88cadbfe164054b66fb1b8b5944f039
                                                                                          • Instruction ID: e7f6ffb8a51b72738f977d67082fa2ce6dcaa9541a343fa872527cd16150313f
                                                                                          • Opcode Fuzzy Hash: 8593e68492e625a236a0775e4afd030aa88cadbfe164054b66fb1b8b5944f039
                                                                                          • Instruction Fuzzy Hash: 89518D75208345AFD314EF65C881F6BB7E8EB85705F044E1DB99583282DB78E90CCB66
                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040A95E
                                                                                          • LoadLibraryW.KERNELBASE(?), ref: 0040A9FC
                                                                                          • SetWindowRgn.USER32(?,00000000,00000001), ref: 0040AA55
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileLibraryLoadModuleNameWindow
                                                                                          • String ID: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\$C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\skins\$lan.dll$skins\
                                                                                          • API String ID: 3279920804-2219576938
                                                                                          • Opcode ID: d1a164a8b43815679eae9372dc4cf641e3c000993ec1a9e2024e82e3784e2960
                                                                                          • Instruction ID: 1a42cd8aab0978e2c3b899118eae82134ecd6680d8d3f1b24819b0116253ca69
                                                                                          • Opcode Fuzzy Hash: d1a164a8b43815679eae9372dc4cf641e3c000993ec1a9e2024e82e3784e2960
                                                                                          • Instruction Fuzzy Hash: FC31C472654300BAD624FB61DC86FDB72A86F84704F00493FF255961C1EFB9D604CBAA
                                                                                          APIs
                                                                                          • GetParent.USER32(?), ref: 0044D4E4
                                                                                          • PeekMessageW.USER32(-00000030,00000000,00000000,00000000,00000000), ref: 0044D50D
                                                                                          • UpdateWindow.USER32(?), ref: 0044D529
                                                                                          • SendMessageW.USER32(?,00000121,00000000,?), ref: 0044D54F
                                                                                          • SendMessageW.USER32(?,0000036A,00000000,00000001), ref: 0044D56E
                                                                                          • UpdateWindow.USER32(?), ref: 0044D5B1
                                                                                          • PeekMessageW.USER32(-00000030,00000000,00000000,00000000,00000000), ref: 0044D5E4
                                                                                            • Part of subcall function 0044DAB9: GetWindowLongW.USER32(?,000000F0), ref: 0044DAC5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message$Window$PeekSendUpdate$LongParent
                                                                                          • String ID:
                                                                                          • API String ID: 2853195852-0
                                                                                          • Opcode ID: ca7a014e66db6d60f8b0e8a03bda7c403b6a06fcc58c2e5f61c5496c4a407b99
                                                                                          • Instruction ID: 74f7651d9fab6e1a7f464e385bdcf6bf3189ddcdd13579ba29f49ffd7d79696f
                                                                                          • Opcode Fuzzy Hash: ca7a014e66db6d60f8b0e8a03bda7c403b6a06fcc58c2e5f61c5496c4a407b99
                                                                                          • Instruction Fuzzy Hash: 8441C670A04341ABE7219F169848E1FBBF4FFC5B09F10091FF44286292DB79D945CB5A
                                                                                          APIs
                                                                                          • KiUserCallbackDispatcher.NTDLL(0000000B), ref: 0045047D
                                                                                          • GetSystemMetrics.USER32(0000000C), ref: 00450484
                                                                                          • GetDC.USER32(00000000), ref: 0045049D
                                                                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 004504AE
                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004504B6
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 004504BE
                                                                                            • Part of subcall function 00454231: GetSystemMetrics.USER32(00000002), ref: 00454243
                                                                                            • Part of subcall function 00454231: GetSystemMetrics.USER32(00000003), ref: 0045424D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
                                                                                          • String ID:
                                                                                          • API String ID: 1031845853-0
                                                                                          • Opcode ID: edd677b4d5de26ae1707d3afd64f7b1fe9797ea57a31054f695cfe463c2767e5
                                                                                          • Instruction ID: d8fb674b1037bc45b442f3b4b88179305e7692e43d03a8c0c8b528612b868e20
                                                                                          • Opcode Fuzzy Hash: edd677b4d5de26ae1707d3afd64f7b1fe9797ea57a31054f695cfe463c2767e5
                                                                                          • Instruction Fuzzy Hash: 87F09034540704AEE6206BB39C49B2B77A4EB81757F10082EF60196292EAB4D805CAA5
                                                                                          APIs
                                                                                            • Part of subcall function 0044E5BA: lstrlenA.KERNEL32(?,00000000,?,00000000,0043649B,0000001C), ref: 0044E5CF
                                                                                          • LoadIconW.USER32(?,00000080), ref: 00409BF9
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: IconLoadlstrlen
                                                                                          • String ID: "$)$hE
                                                                                          • API String ID: 1871186966-1336629357
                                                                                          • Opcode ID: 349fc0c3192dcda8be95434a113b3984ae7f9b21d2389fab9e216ac8b5df377a
                                                                                          • Instruction ID: 968370c9d49dbb55a53c94ea5a0d81e75859f17e49eacc3c1b25e9c65e92d028
                                                                                          • Opcode Fuzzy Hash: 349fc0c3192dcda8be95434a113b3984ae7f9b21d2389fab9e216ac8b5df377a
                                                                                          • Instruction Fuzzy Hash: E7814230009B818AD315EF75D659B9ABBE46F65708F040C5EF4DA222C2DBB87608C77B
                                                                                          APIs
                                                                                            • Part of subcall function 004259C0: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000), ref: 00425A3E
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                            • Part of subcall function 0044E5BA: lstrlenA.KERNEL32(?,00000000,?,00000000,0043649B,0000001C), ref: 0044E5CF
                                                                                            • Part of subcall function 0044E730: __EH_prolog.LIBCMT ref: 0044E735
                                                                                            • Part of subcall function 0044E638: InterlockedIncrement.KERNEL32(-000000F4), ref: 0044E67B
                                                                                          • DeleteFileW.KERNELBASE(?,00000000,?,?,?,config\sequence.dat), ref: 00409129
                                                                                            • Part of subcall function 0044E25E: InterlockedIncrement.KERNEL32(?), ref: 0044E273
                                                                                            • Part of subcall function 00419E00: wsprintfW.USER32 ref: 00419E3B
                                                                                            • Part of subcall function 00419E00: WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00419E5C
                                                                                            • Part of subcall function 00419D20: WritePrivateProfileStructW.KERNEL32(?,?,?,?,?), ref: 00419D55
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Interlocked$FileIncrementPrivateProfileWrite$DecrementDeleteH_prologModuleNameStringStructlstrlenwsprintf
                                                                                          • String ID: Macros$config\sequence.dat$number
                                                                                          • API String ID: 948302055-633137079
                                                                                          • Opcode ID: cd851698a95347fc5bca8c76fc3ced950f54463460fa41ae317e941e96384f6d
                                                                                          • Instruction ID: 5c530a285c1044307a13ecffd9d166d63d783758ce7eb7b5146f2a176b0bc26e
                                                                                          • Opcode Fuzzy Hash: cd851698a95347fc5bca8c76fc3ced950f54463460fa41ae317e941e96384f6d
                                                                                          • Instruction Fuzzy Hash: 94519371109381AFD304EB1AC551A5FBBE4BF95B18F440A0EF4D553282DB78A908CB67
                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(00000000,?,00000000,00000000,00000000,00002010), ref: 00407E4E
                                                                                          • LoadImageW.USER32(00000000), ref: 00407E55
                                                                                          • GetObjectW.GDI32(00000000,00000018,?), ref: 00407E99
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: HandleImageLoadModuleObject
                                                                                          • String ID: hE
                                                                                          • API String ID: 3237699403-2023966264
                                                                                          • Opcode ID: 38a8522daa9f99087085e424f9fb589b90b8cca2c673998bde60e6d746af59ba
                                                                                          • Instruction ID: f9799a2ec47714df41a882b7c7a4d285a63652948ba99a81049c4b7ab124470a
                                                                                          • Opcode Fuzzy Hash: 38a8522daa9f99087085e424f9fb589b90b8cca2c673998bde60e6d746af59ba
                                                                                          • Instruction Fuzzy Hash: E2313770644700AFD314CF55C845B2BBBE4FB88714F10891EF985873A1E7B9E449CB46
                                                                                          APIs
                                                                                          • GetParent.USER32(?), ref: 00403C69
                                                                                          • PostMessageW.USER32(?,00000464,?,?), ref: 00403C8D
                                                                                          • PostMessageW.USER32(000104EA,00000465,?,00000000), ref: 00403CAB
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessagePost$Parent
                                                                                          • String ID: GG
                                                                                          • API String ID: 2469326541-2425131523
                                                                                          • Opcode ID: 6efe49b7fe3ecc3503d50835c3d7df7dc00138f3cd6a124087988af1024f7488
                                                                                          • Instruction ID: ba236005c8e8aafa0554430739561ed4ecbe5120c7c92d8ee69879b31d46cf90
                                                                                          • Opcode Fuzzy Hash: 6efe49b7fe3ecc3503d50835c3d7df7dc00138f3cd6a124087988af1024f7488
                                                                                          • Instruction Fuzzy Hash: C0F030B22007007FE2149B96DC89D5BB36CEBCA755F11842AFB0097291DA78FC02877C
                                                                                          APIs
                                                                                          • OpenFileMappingW.KERNELBASE(00000006,00000000,SI-998-ShareData,75C05540,00409D94,1.04,?,N/A), ref: 0040E70C
                                                                                          • MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000000,?,N/A), ref: 0040E72A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$MappingOpenView
                                                                                          • String ID: Could not map view of file.$SI-998-ShareData
                                                                                          • API String ID: 3439327939-1567116081
                                                                                          • Opcode ID: c21fdb69a23e2fdec25d4de7f53394c498033f2c8d921419b309b75230797afb
                                                                                          • Instruction ID: 04432728ecec64843c089bfba76c327345aea80ab1e5f21c6df26477286dfd0c
                                                                                          • Opcode Fuzzy Hash: c21fdb69a23e2fdec25d4de7f53394c498033f2c8d921419b309b75230797afb
                                                                                          • Instruction Fuzzy Hash: 70E0D8703403102AF7745B3A7C8FFE7278C9B40B12F114477B508EB2D5D6A89C81565C
                                                                                          APIs
                                                                                          • lstrlenA.KERNEL32(?), ref: 0044D3DE
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000001), ref: 0044D402
                                                                                          • SendDlgItemMessageW.USER32(?,?,0000040B,00000000,00000001), ref: 0044D422
                                                                                          • SendDlgItemMessageA.USER32(?,?,?,00000000,?), ref: 0044D443
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ItemMessageSend$ByteCharMultiWidelstrlen
                                                                                          • String ID:
                                                                                          • API String ID: 3573766508-0
                                                                                          • Opcode ID: 425f43fa1761678336a0a33b315aff71dae86a5785560a291eedaef7403c0f8e
                                                                                          • Instruction ID: 381b26ea8816ef3c5db50f1eef5452be1ef9941118510756dad1ab335a99406f
                                                                                          • Opcode Fuzzy Hash: 425f43fa1761678336a0a33b315aff71dae86a5785560a291eedaef7403c0f8e
                                                                                          • Instruction Fuzzy Hash: 0131A675C00215BAEB209F59DC849EFBBB8EB85325F548127F951A2290C3789E42C769
                                                                                          APIs
                                                                                          • GetVersion.KERNEL32(?,?,?,0045420C), ref: 00454288
                                                                                          • GetProcessVersion.KERNELBASE(00000000,?,?,?,0045420C), ref: 004542C5
                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 004542F3
                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 004542FE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CursorLoadVersion$Process
                                                                                          • String ID:
                                                                                          • API String ID: 2246821583-0
                                                                                          • Opcode ID: 76dce00a4fa28b77b94c7536bc815c09fcb67851379816d9b334921fb404d703
                                                                                          • Instruction ID: 158c1ec08701c263d3402b046e965d66df34c3fbbe17b4d2ae6ddee11a9bdc32
                                                                                          • Opcode Fuzzy Hash: 76dce00a4fa28b77b94c7536bc815c09fcb67851379816d9b334921fb404d703
                                                                                          • Instruction Fuzzy Hash: 9D118FB1A007508FD728DF3A988452ABBE5FB487497004D3FE18BC6B91E778E445CB54
                                                                                          APIs
                                                                                          • GetTopWindow.USER32(?), ref: 0044C967
                                                                                          • SendMessageW.USER32(00000000,?,?,?), ref: 0044C99D
                                                                                          • GetTopWindow.USER32(00000000), ref: 0044C9AA
                                                                                          • GetWindow.USER32(00000000,00000002), ref: 0044C9C8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$MessageSend
                                                                                          • String ID:
                                                                                          • API String ID: 1496643700-0
                                                                                          • Opcode ID: 977b870bbdaf020cf1bf2e4c35a83683be4d1d1683519fd288c7e077b40a6968
                                                                                          • Instruction ID: 0c60490943ad249c0fce72d5722fdd78314a46b3fba3863df13473b9d63f839e
                                                                                          • Opcode Fuzzy Hash: 977b870bbdaf020cf1bf2e4c35a83683be4d1d1683519fd288c7e077b40a6968
                                                                                          • Instruction Fuzzy Hash: 80010C7200221ABBEF525F96EC45EDF3B2ABF05751F084016FA1051161D73ACA22EBE9
                                                                                          APIs
                                                                                          • _TrackMouseEvent.COMCTL32 ref: 004082A5
                                                                                          • PostMessageW.USER32(000104EA,00000465,00000001,00000000), ref: 004082EA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: EventMessageMousePostTrack
                                                                                          • String ID: GG
                                                                                          • API String ID: 3330639917-2425131523
                                                                                          • Opcode ID: f3cf95019428555918633a168eb5087b546420c2d874ec82229a7ac3b315f176
                                                                                          • Instruction ID: 4c54499b37aef403855b7c7af55f16e9a429924d77c291c6f78338ec67f67a0b
                                                                                          • Opcode Fuzzy Hash: f3cf95019428555918633a168eb5087b546420c2d874ec82229a7ac3b315f176
                                                                                          • Instruction Fuzzy Hash: BC01F2702007019FE318DF29D845BDBB7F8EB94705F00482EF64997381EBB4E9448BAA
                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0044ECE3
                                                                                          • SetWindowsHookExW.USER32(000000FF,VZD,00000000,00000000), ref: 0044ECF3
                                                                                            • Part of subcall function 0045407C: __EH_prolog.LIBCMT ref: 00454081
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentH_prologHookThreadWindows
                                                                                          • String ID: VZD
                                                                                          • API String ID: 2183259885-2028149151
                                                                                          • Opcode ID: e4ff36b8aa95966caabaf613bb38e618367bbb583acc1dbcb5ce429f9afa4435
                                                                                          • Instruction ID: c546161f4b5568f377d08fef494ce438cf1e9b4dcfc90f926e83f02c8e023f76
                                                                                          • Opcode Fuzzy Hash: e4ff36b8aa95966caabaf613bb38e618367bbb583acc1dbcb5ce429f9afa4435
                                                                                          • Instruction Fuzzy Hash: DEF027718002006BDB202FF5A90DB167660AF45767F11066FB9128A1D3DB6C8A4CC35D
                                                                                          APIs
                                                                                          • HeapReAlloc.KERNEL32(00000000,?,00000000,00000000,0043F315,00000000,?,?,?,0043910C), ref: 0043F575
                                                                                          • HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0043F315,00000000,?,?,?,0043910C), ref: 0043F5A9
                                                                                          • VirtualAlloc.KERNELBASE(00000000,00100000,00002000,00000004,?,0043910C), ref: 0043F5C3
                                                                                          • HeapFree.KERNEL32(00000000,?,?,0043910C), ref: 0043F5DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeap$FreeVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 3499195154-0
                                                                                          • Opcode ID: b8074a46842fc97b55feaf4d0915b7e01a1457bcabebcb30de6ae6f6197ecf7c
                                                                                          • Instruction ID: 77407620ddee79fd799d42592f22a46d1e476ae414b899113b56263a1784c679
                                                                                          • Opcode Fuzzy Hash: b8074a46842fc97b55feaf4d0915b7e01a1457bcabebcb30de6ae6f6197ecf7c
                                                                                          • Instruction Fuzzy Hash: F6116631200700AFD7218F2DEC49962BBB6FBAC311B20093FE156C22B5D770AD09CB08
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32 ref: 004080FB
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00408121
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0040817B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: BeginClientCompatibleCreateH_prologPaintRect
                                                                                          • String ID:
                                                                                          • API String ID: 289356175-0
                                                                                          • Opcode ID: edbf929965de98563163f1b05042f95720e3c2167a5b8441bcebac2c9581e181
                                                                                          • Instruction ID: 750318fe911b71d18a1a97b63c86227f56e382a2c51d4e7ce98305dc57c4688e
                                                                                          • Opcode Fuzzy Hash: edbf929965de98563163f1b05042f95720e3c2167a5b8441bcebac2c9581e181
                                                                                          • Instruction Fuzzy Hash: 8A319E75108341AFC324DF25C845F6BB7E8FB84715F048A2DF89993281DB38E909CB66
                                                                                          APIs
                                                                                          • SendMessageW.USER32(?,0000040D,00000000,00000000), ref: 00403971
                                                                                          • GetClientRect.USER32(?,?), ref: 00403980
                                                                                            • Part of subcall function 0044997E: SendMessageW.USER32(?,00000432,00000000,?), ref: 004499C1
                                                                                          • SendMessageW.USER32(?,00000401,?,00000000), ref: 004039BA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend$ClientRect
                                                                                          • String ID:
                                                                                          • API String ID: 1925248871-0
                                                                                          • Opcode ID: 1365c6b79ef8c9891300f3105ac9ce640e5533258e748448e4ebcfe5eb0fdf12
                                                                                          • Instruction ID: d51efa30f9a34ee506207d76bca3378ce835e853ec5ab4c9b5eaa92b4ff52bfb
                                                                                          • Opcode Fuzzy Hash: 1365c6b79ef8c9891300f3105ac9ce640e5533258e748448e4ebcfe5eb0fdf12
                                                                                          • Instruction Fuzzy Hash: DA1170B1200701AFE624EB99DC81F67B3EDBF88704F00881EB64697691E6B4F9058768
                                                                                          APIs
                                                                                          • FindResourceW.KERNEL32(?,?,000000F0,?,?,?,0044AC87,?,?,00409C70), ref: 0044D334
                                                                                          • LoadResource.KERNEL32(?,00000000,?,?,?,0044AC87,?,?,00409C70), ref: 0044D340
                                                                                          • LockResource.KERNEL32(00000000,?,?,?,0044AC87,?,?,00409C70), ref: 0044D34F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$FindLoadLock
                                                                                          • String ID:
                                                                                          • API String ID: 2752051264-0
                                                                                          • Opcode ID: 4c0f00dc669fd3cc1ac78ef8ef6f1d092cbf559a202386eb16f94314086bf964
                                                                                          • Instruction ID: 328a71c42fde73a9486682d1512b70636c95d04c322731b50f36859874fba58a
                                                                                          • Opcode Fuzzy Hash: 4c0f00dc669fd3cc1ac78ef8ef6f1d092cbf559a202386eb16f94314086bf964
                                                                                          • Instruction Fuzzy Hash: 89E06D72604301ABA6155F625C4886BB76EAFD1762F18097BFA02D2122CF28CD01D66F
                                                                                          APIs
                                                                                          • KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 0044F23A
                                                                                          • TranslateMessage.USER32(?), ref: 0044F25A
                                                                                          • DispatchMessageW.USER32(?), ref: 0044F261
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message$CallbackDispatchDispatcherTranslateUser
                                                                                          • String ID:
                                                                                          • API String ID: 2960505505-0
                                                                                          • Opcode ID: f4c190e215fed5a89d292a77fa62982e0ddb75816b9ef65b5eb67c813b3bcd2f
                                                                                          • Instruction ID: de851bec186cdabf1850b6073e04db4e91e4945471000b3a7ace04e6c438e1fd
                                                                                          • Opcode Fuzzy Hash: f4c190e215fed5a89d292a77fa62982e0ddb75816b9ef65b5eb67c813b3bcd2f
                                                                                          • Instruction Fuzzy Hash: A5E09232204600ABF7295B65AC48E7B33ACFF89B02704047EF801C6110CBA5DD468A6A
                                                                                          APIs
                                                                                          • RegQueryValueExW.KERNELBASE ref: 0042302E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: QueryValue
                                                                                          • String ID: P
                                                                                          • API String ID: 3660427363-3110715001
                                                                                          • Opcode ID: 5724e7f8464f72ffb5538fc7e822d3731efd8bcfa7c47de95c6aec67fc2d7359
                                                                                          • Instruction ID: 65f76401cdb4c2df68a49eb0543352f4d445712a0f8683aea76f03b45a302446
                                                                                          • Opcode Fuzzy Hash: 5724e7f8464f72ffb5538fc7e822d3731efd8bcfa7c47de95c6aec67fc2d7359
                                                                                          • Instruction Fuzzy Hash: 9EE0B6B0108307AFD604DF44ED44B6BBBE8ABC4B09F40491CF58896181D270A90C8B67
                                                                                          APIs
                                                                                            • Part of subcall function 0044DAB9: GetWindowLongW.USER32(?,000000F0), ref: 0044DAC5
                                                                                          • GetWindowRect.USER32(?,?), ref: 0044B015
                                                                                          • GetWindow.USER32(?,00000004), ref: 0044B032
                                                                                            • Part of subcall function 0044DC46: IsWindowEnabled.USER32(?), ref: 0044DC50
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$EnabledLongRect
                                                                                          • String ID:
                                                                                          • API String ID: 3170195891-0
                                                                                          • Opcode ID: f9b602eaca5a5a48e7332d44d69cf61754b087e0e5a00d374cfb53e74476efd7
                                                                                          • Instruction ID: 2355246451fcd200359da6a6f64834ba849078d5f047aeca2e6d1b0540dd4b82
                                                                                          • Opcode Fuzzy Hash: f9b602eaca5a5a48e7332d44d69cf61754b087e0e5a00d374cfb53e74476efd7
                                                                                          • Instruction Fuzzy Hash: 29017C30600304DBEF25EF69C855BAF77A9EF10709F00441AEE61A73A1DB39ED00C698
                                                                                          APIs
                                                                                          • wsprintfW.USER32 ref: 00419E3B
                                                                                          • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00419E5C
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfileStringWritewsprintf
                                                                                          • String ID:
                                                                                          • API String ID: 3064552202-0
                                                                                          • Opcode ID: 42bad30613c8fd86e2983225b6861c0aea42f2a88c876e5059dec263ee1a549f
                                                                                          • Instruction ID: dd110672409edd3bc26559a9b546e781357dac8883cf781b55904f6a90aeca1e
                                                                                          • Opcode Fuzzy Hash: 42bad30613c8fd86e2983225b6861c0aea42f2a88c876e5059dec263ee1a549f
                                                                                          • Instruction Fuzzy Hash: 560184B5544390ABD334DB58D949FEAB7E8FB98710F104B1DB869833C1D7385804CB96
                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004212A7
                                                                                          • SetWindowsHookExW.USER32(00000004,00421570,?,00000000), ref: 004212B9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentHookThreadWindows
                                                                                          • String ID:
                                                                                          • API String ID: 1904029216-0
                                                                                          • Opcode ID: 1a3e1d1a8fad2683dce4b9b02ee7ffda579a0d7f5017f2fd575c2e6add76267a
                                                                                          • Instruction ID: ed35c91780c2c7eca641d4efa18c94278e451d4204c0864befcee8a1549aa80a
                                                                                          • Opcode Fuzzy Hash: 1a3e1d1a8fad2683dce4b9b02ee7ffda579a0d7f5017f2fd575c2e6add76267a
                                                                                          • Instruction Fuzzy Hash: 78F0A9B0600280AFE3009FAAFC09B1677D8AB64310F0200BBF108C22A4EA38A904CB19
                                                                                          APIs
                                                                                          • SetErrorMode.KERNELBASE(00000000,00000000,00450B55,00000000,00000000,00000000,00000000,?,00000000,?,0044869C,00000000,00000000,00000000,00000000,0043917B), ref: 00454537
                                                                                          • SetErrorMode.KERNELBASE(00000000,?,00000000,?,0044869C,00000000,00000000,00000000,00000000,0043917B,00000000), ref: 0045453E
                                                                                            • Part of subcall function 00454591: GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 004545C2
                                                                                            • Part of subcall function 00454591: lstrcpyW.KERNEL32(?,.HLP,?,?,00000104), ref: 00454663
                                                                                            • Part of subcall function 00454591: lstrcatW.KERNEL32(?,.INI,?,?,00000104), ref: 00454692
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
                                                                                          • String ID:
                                                                                          • API String ID: 3389432936-0
                                                                                          • Opcode ID: 0ddc34bb983d7cc5bd60d6101d3e447f5a8b297e5afa61069f8c82c476c8f379
                                                                                          • Instruction ID: 3ca002b65a112de9f4fa786ff915a4b0c54e60aba1cf8a4cc1d4de1d48627935
                                                                                          • Opcode Fuzzy Hash: 0ddc34bb983d7cc5bd60d6101d3e447f5a8b297e5afa61069f8c82c476c8f379
                                                                                          • Instruction Fuzzy Hash: D8F0A9B09043149FD714EF65D454B097BE8AF88326F01849FF8448B3A3CB78D884CB9A
                                                                                          APIs
                                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 0044BB52
                                                                                          • CallWindowProcW.USER32(?,?,?,?,?), ref: 0044BB67
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ProcWindow$Call
                                                                                          • String ID:
                                                                                          • API String ID: 2316559721-0
                                                                                          • Opcode ID: a683a142e255a731e3dd842bd594915c8e8b468b4036db03fb7ec56d0ece4f9e
                                                                                          • Instruction ID: c3ed87dffc77486829bbf1f5540dcba7479e9dab3bf9d7e6c33455e617d3fa68
                                                                                          • Opcode Fuzzy Hash: a683a142e255a731e3dd842bd594915c8e8b468b4036db03fb7ec56d0ece4f9e
                                                                                          • Instruction Fuzzy Hash: 03F01536100208FFDF218F95DC04D9A7BBAFF08362B04C429FA4986530D732E921AB94
                                                                                          APIs
                                                                                            • Part of subcall function 00453FE7: TlsGetValue.KERNEL32(00498528,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36,?,00000000,?,0044869C,00000000,00000000,00000000,00000000), ref: 00454026
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0044B783
                                                                                          • SetWindowsHookExW.USER32(00000005,Function_0004B5BD,00000000,00000000), ref: 0044B793
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentHookThreadValueWindows
                                                                                          • String ID:
                                                                                          • API String ID: 933525246-0
                                                                                          • Opcode ID: a7f6ec20841b254339dd2f888e4a56eba0609ba820c387fe63e1f6bade00ec00
                                                                                          • Instruction ID: 061fce043a83e1488aaa5b9ab4aa41b508ac7f066b4aa348da0a5ae69381795b
                                                                                          • Opcode Fuzzy Hash: a7f6ec20841b254339dd2f888e4a56eba0609ba820c387fe63e1f6bade00ec00
                                                                                          • Instruction Fuzzy Hash: 80E06D31600700AEE3B09F669C05B17B6E8DFC5B16F20462FF606C6181E778D909CBAE
                                                                                          APIs
                                                                                          • RegOpenKeyExW.KERNELBASE(004856F0,?,00000000,000F003F,?,00474CF0,004856F0,?,00424732,80000001,?,?,?,Control Panel\Mouse,00474CF0,004856F0), ref: 00422FD9
                                                                                          • RegCreateKeyW.ADVAPI32(004856F0,?,?), ref: 00422FEA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateOpen
                                                                                          • String ID:
                                                                                          • API String ID: 436179556-0
                                                                                          • Opcode ID: b181f7e3cdc2a756106e759534901d386df46d9132a4783d5b941334f072945c
                                                                                          • Instruction ID: cb1efde9e6015171a5aebe97ac83a6afde5a5489cd6f3c16f7999c987c4ce56d
                                                                                          • Opcode Fuzzy Hash: b181f7e3cdc2a756106e759534901d386df46d9132a4783d5b941334f072945c
                                                                                          • Instruction Fuzzy Hash: 31E0127234532277C6244E66ED48E97BBACEBDAF62F140819B305E71D2C6A0E804D776
                                                                                          APIs
                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000,004390FA,00000001), ref: 0043C73E
                                                                                            • Part of subcall function 0043EEB0: HeapAlloc.KERNEL32(00000000,00000140,0043C752), ref: 0043EEBD
                                                                                          • HeapDestroy.KERNEL32 ref: 0043C75C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$AllocCreateDestroy
                                                                                          • String ID:
                                                                                          • API String ID: 2236781399-0
                                                                                          • Opcode ID: f45e841d16c2d41e02fb185de3014f11ee27ef1d05ba8090c6ce3421ac0cadda
                                                                                          • Instruction ID: 7f7d94094ce717c2774b0cc691e6079ae5383fd1b79ac9ce9eae4d19692736fe
                                                                                          • Opcode Fuzzy Hash: f45e841d16c2d41e02fb185de3014f11ee27ef1d05ba8090c6ce3421ac0cadda
                                                                                          • Instruction Fuzzy Hash: FAE05B70619301AAFB503B359E4976636D89B5C783F00543BF900D81F4FB78D950EB09
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 0044B145
                                                                                            • Part of subcall function 00453FE7: TlsGetValue.KERNEL32(00498528,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36,?,00000000,?,0044869C,00000000,00000000,00000000,00000000), ref: 00454026
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: H_prologValue
                                                                                          • String ID:
                                                                                          • API String ID: 3700342317-0
                                                                                          • Opcode ID: 158db520141749e4b163839bfa3f3803571bb0431781b7f724d2f433835d8b78
                                                                                          • Instruction ID: b02fe635a920dd676c909a31f4edd2005997ca4535186bae74cd60ee4ed905b9
                                                                                          • Opcode Fuzzy Hash: 158db520141749e4b163839bfa3f3803571bb0431781b7f724d2f433835d8b78
                                                                                          • Instruction Fuzzy Hash: E6213572900209ABEF01DF54C881AEE7BB9FF48359F10006AF915AB241D778AA54CBE4
                                                                                          APIs
                                                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044B88D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateWindow
                                                                                          • String ID:
                                                                                          • API String ID: 716092398-0
                                                                                          • Opcode ID: 89c86329aa9cfa3e4603f4c16058366b3982918cc4f161b3e96366d582b2a8d7
                                                                                          • Instruction ID: 3aac7ecd34fb83ad1e7a095952163faa7a55ab40d8f88e6903344abe37fae119
                                                                                          • Opcode Fuzzy Hash: 89c86329aa9cfa3e4603f4c16058366b3982918cc4f161b3e96366d582b2a8d7
                                                                                          • Instruction Fuzzy Hash: E131AB79A00219AFCF01DFA8C8449DEBBF1FF4C314B10406AF908E7220D7359A509FA4
                                                                                          APIs
                                                                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?,?,00000001,?,?,00000022,00408210,?,?,00402128,00000000), ref: 0042237E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: InvalidateRect
                                                                                          • String ID:
                                                                                          • API String ID: 634782764-0
                                                                                          • Opcode ID: 94dba801b6ae83634e9a8519bcb98ed6d87e75489f3e9658ec2134afa49456f7
                                                                                          • Instruction ID: b8bd4749fb3d98dbae6e3a14a66a65ac313cd1ebea7ba8a8ae120830be465629
                                                                                          • Opcode Fuzzy Hash: 94dba801b6ae83634e9a8519bcb98ed6d87e75489f3e9658ec2134afa49456f7
                                                                                          • Instruction Fuzzy Hash: 01014C71300A009FC728DE7DD995B6BB7EAABC8304F44892EA286C7640DAA4FC058794
                                                                                          APIs
                                                                                          • GetPrivateProfileStringW.KERNEL32 ref: 00419C28
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfileString
                                                                                          • String ID:
                                                                                          • API String ID: 4250705333-0
                                                                                          • Opcode ID: c92c3de4c8ae003a048453960085fed7d8322b2ba90e8751ebbfc10d18a0e2c8
                                                                                          • Instruction ID: 14fff0806d037ba1d5d9369dbaf87cba41ffa83e5e596e173a3ccee71f739191
                                                                                          • Opcode Fuzzy Hash: c92c3de4c8ae003a048453960085fed7d8322b2ba90e8751ebbfc10d18a0e2c8
                                                                                          • Instruction Fuzzy Hash: C211F5755082D0AEE335DB55C455BDAB7E4AB98B54F008A0EF1CD83281C7FC69888B66
                                                                                          APIs
                                                                                          • SendMessageW.USER32(FFFFFFFF,00000401,00000000,00000000), ref: 004038EA
                                                                                            • Part of subcall function 0044975E: __EH_prolog.LIBCMT ref: 00449763
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: H_prologMessageSend
                                                                                          • String ID:
                                                                                          • API String ID: 2337391251-0
                                                                                          • Opcode ID: 1913585afb597a850ff901e0910279752f0f847fe83094996ede44b74e95fc73
                                                                                          • Instruction ID: 3c0941a801d33c63fa8731d80a884388e4900017c2174d8b1cb50a8a09ad0722
                                                                                          • Opcode Fuzzy Hash: 1913585afb597a850ff901e0910279752f0f847fe83094996ede44b74e95fc73
                                                                                          • Instruction Fuzzy Hash: 0901A2B1654740AFE764EF298C02B1777E8BB44B20F008A2EB511D7BC1E7BCE8048B45
                                                                                          APIs
                                                                                            • Part of subcall function 0044DAB9: GetWindowLongW.USER32(?,000000F0), ref: 0044DAC5
                                                                                          • SendMessageW.USER32(?,0000036E,?,?), ref: 0044B0BD
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LongMessageSendWindow
                                                                                          • String ID:
                                                                                          • API String ID: 3360111000-0
                                                                                          • Opcode ID: be877764c1c3aaca3940d9c4e12353ad44fbe765e4589f6da98c915627b71bb1
                                                                                          • Instruction ID: cdb48c2fc54fa8884c71ebaef5953b0cc4c8d68f2d8a27ec13141fb7213d8809
                                                                                          • Opcode Fuzzy Hash: be877764c1c3aaca3940d9c4e12353ad44fbe765e4589f6da98c915627b71bb1
                                                                                          • Instruction Fuzzy Hash: 06F06875A00208BBEF159F96C441AAFB7B9FF54355F10441BE90197241E7B5ED014BA4
                                                                                          APIs
                                                                                          • GetPrivateProfileStructW.KERNEL32(?,00000000,?,?,?), ref: 00419DC5
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfileStruct
                                                                                          • String ID:
                                                                                          • API String ID: 3648059442-0
                                                                                          • Opcode ID: 5ddd400ce026de479c799f27457a000153489cfa630d41638d2ff7f8a7b27c66
                                                                                          • Instruction ID: 92e34fb0d60e5cec7be7b86673e007442ed8fc01a6c5a9b0697ca122245af879
                                                                                          • Opcode Fuzzy Hash: 5ddd400ce026de479c799f27457a000153489cfa630d41638d2ff7f8a7b27c66
                                                                                          • Instruction Fuzzy Hash: 0FF0F9B6108791AFC204CF59C851F5BB7E8FB98B24F004B1DF4A993391D738A904CB66
                                                                                          APIs
                                                                                          • RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00439F1E,000000E0,00439F0B,?,0043D7C4,00000018,00000000,?,?,00440494,00000009), ref: 00439F7F
                                                                                            • Part of subcall function 0043D7A4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00440494,00000009,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 0043D7E1
                                                                                            • Part of subcall function 0043D7A4: EnterCriticalSection.KERNEL32(?,?,?,00440494,00000009,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 0043D7FC
                                                                                            • Part of subcall function 0043D805: LeaveCriticalSection.KERNEL32(?,00439F5E,00000009,?,00000009,00000000,?,00439F1E,000000E0,00439F0B,?,0043D7C4,00000018,00000000,?), ref: 0043D812
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$AllocateEnterHeapInitializeLeave
                                                                                          • String ID:
                                                                                          • API String ID: 495028619-0
                                                                                          • Opcode ID: ef5011dce21aec95bbf02202309264d16ae182e7a98dff0172f16165ddbd3422
                                                                                          • Instruction ID: 6b8ddd2e66ffc669a71c7c8d78b6003cb1d25276a3610522b149e69f8a63f1f9
                                                                                          • Opcode Fuzzy Hash: ef5011dce21aec95bbf02202309264d16ae182e7a98dff0172f16165ddbd3422
                                                                                          • Instruction Fuzzy Hash: F9E0E532E45A20A6D7113229BC01B8B62049B8C764F2E1037FD18AB2D5D6E5AC40429C
                                                                                          APIs
                                                                                            • Part of subcall function 00449A03: GetParent.USER32(?), ref: 00449A32
                                                                                          • SendMessageW.USER32(?,00000432,00000000,?), ref: 004499C1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageParentSend
                                                                                          • String ID:
                                                                                          • API String ID: 928151917-0
                                                                                          • Opcode ID: 1e7ce0861c3f60a61ddc49c808d8e9e2fd3a4f8822712e868abdeec5c3208922
                                                                                          • Instruction ID: 83c130992535d57580071a9ee0ca68f446e36acfccae2a66508fb5f0627307dd
                                                                                          • Opcode Fuzzy Hash: 1e7ce0861c3f60a61ddc49c808d8e9e2fd3a4f8822712e868abdeec5c3208922
                                                                                          • Instruction Fuzzy Hash: 1AF0FE7280020CBBDF119FA5DC45FDE77B8EB08314F048426F911A6191E7B5DA54DB65
                                                                                          APIs
                                                                                          • SendMessageW.USER32(?,00000465,00000000,00000000), ref: 0040297C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend
                                                                                          • String ID:
                                                                                          • API String ID: 3850602802-0
                                                                                          • Opcode ID: afa57f54f8a9ba88d02919ddf09b19e71b85587a749043b65e23bb7e1b9805f9
                                                                                          • Instruction ID: 4381dfdf455fb97059773cfb7639960c6a1d46d2834246df972c8dc208d657af
                                                                                          • Opcode Fuzzy Hash: afa57f54f8a9ba88d02919ddf09b19e71b85587a749043b65e23bb7e1b9805f9
                                                                                          • Instruction Fuzzy Hash: 20E092B27003106BD2248A468C89F6FE769E7D4B24F10482EFA84973C0D6B4EC0186B5
                                                                                          APIs
                                                                                          • GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 00419EE0
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedPrivateProfile
                                                                                          • String ID:
                                                                                          • API String ID: 3423501712-0
                                                                                          • Opcode ID: c4ec1df5667ea37e7552cb136dfbba8d4e3da7ec7edf54764aa6d38d126f986b
                                                                                          • Instruction ID: ad5d3be72ebcf36f715b80b614474e468bd4ba37a7c9dbbd1cda0ee376f819e6
                                                                                          • Opcode Fuzzy Hash: c4ec1df5667ea37e7552cb136dfbba8d4e3da7ec7edf54764aa6d38d126f986b
                                                                                          • Instruction Fuzzy Hash: A7F017B6108651AFD204CF19D951F5AB7E8FB88B21F008B1DF8A5837D1D738A809CB62
                                                                                          APIs
                                                                                            • Part of subcall function 00403940: SendMessageW.USER32(?,0000040D,00000000,00000000), ref: 00403971
                                                                                            • Part of subcall function 00403940: GetClientRect.USER32(?,?), ref: 00403980
                                                                                            • Part of subcall function 00403940: SendMessageW.USER32(?,00000401,?,00000000), ref: 004039BA
                                                                                          • SendMessageW.USER32(?,00000407,00000000,?), ref: 00403922
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend$ClientRect
                                                                                          • String ID:
                                                                                          • API String ID: 1925248871-0
                                                                                          • Opcode ID: 1c70c66a081f5536f636746414b3c5a186f057e944d8db26cc3dba86f24cbe82
                                                                                          • Instruction ID: 2f212dec69fc235077fce4a5189edb29282fc2884e0efd1d932dd0c7155013b8
                                                                                          • Opcode Fuzzy Hash: 1c70c66a081f5536f636746414b3c5a186f057e944d8db26cc3dba86f24cbe82
                                                                                          • Instruction Fuzzy Hash: 7FE0C272200600BBE214AA92CC55E5BB7BCEBC4B10F00882FF3419B290D6F4F802C7E4
                                                                                          APIs
                                                                                            • Part of subcall function 00449A03: GetParent.USER32(?), ref: 00449A32
                                                                                          • SendMessageW.USER32(?,00000439,00000000,?), ref: 004499F8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageParentSend
                                                                                          • String ID:
                                                                                          • API String ID: 928151917-0
                                                                                          • Opcode ID: b8760d3a99bd6f18b0d304915a3630ca9c22785c5916d8ff5c75a65afe10637a
                                                                                          • Instruction ID: db702d4e716d0b917b7b44c46ec7ccfd1cae63f9fd8cabefb3ced0785ddcc960
                                                                                          • Opcode Fuzzy Hash: b8760d3a99bd6f18b0d304915a3630ca9c22785c5916d8ff5c75a65afe10637a
                                                                                          • Instruction Fuzzy Hash: 72E0BF76900308BFDB11AFA5DC45ECE7BBDEB08314F008516F911A6151E6B0EA14DBA4
                                                                                          APIs
                                                                                          • IsDialogMessageW.USER32(?,?), ref: 0044DAAF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DialogMessage
                                                                                          • String ID:
                                                                                          • API String ID: 547518314-0
                                                                                          • Opcode ID: b849f4d35aba0d4f3ba2ac8c10bc10c9a3ffee7fca632af7c647137f23308ba3
                                                                                          • Instruction ID: 4036f970c1dfc8c10f359f441f1bdf27129e98718f7ab79d0f6fe85173f555cd
                                                                                          • Opcode Fuzzy Hash: b849f4d35aba0d4f3ba2ac8c10bc10c9a3ffee7fca632af7c647137f23308ba3
                                                                                          • Instruction Fuzzy Hash: B0E08631104201AFC3159F14C408A967BE1AF49301B0585A9F44542221C734C941C745
                                                                                          APIs
                                                                                          • LoadStringW.USER32(?,?,?,?), ref: 00450563
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LoadString
                                                                                          • String ID:
                                                                                          • API String ID: 2948472770-0
                                                                                          • Opcode ID: 6ae9f099920e7118521d5d2c94add7c87ec7f0b92ba3364e2b62753447229451
                                                                                          • Instruction ID: d90eade4b3ff65c46513407fd3a0c10fd21e0806da1b4c27457c3e52106664e9
                                                                                          • Opcode Fuzzy Hash: 6ae9f099920e7118521d5d2c94add7c87ec7f0b92ba3364e2b62753447229451
                                                                                          • Instruction Fuzzy Hash: 44D05E76404351EB8601DF618808C4FBBE4BF943A1B004C0EF84083112F324C4148B69
                                                                                          APIs
                                                                                          • SetWindowTextW.USER32(?,?), ref: 0044DB2C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: TextWindow
                                                                                          • String ID:
                                                                                          • API String ID: 530164218-0
                                                                                          • Opcode ID: 7e847e2b0e9dc778d3092745146b396e827d81f5677a1a401d660c9bc72b8f77
                                                                                          • Instruction ID: d88937024c48c8e1f0cdf63042ecf748425314c33cfc8d4f2efd0c6f4b9a9dcf
                                                                                          • Opcode Fuzzy Hash: 7e847e2b0e9dc778d3092745146b396e827d81f5677a1a401d660c9bc72b8f77
                                                                                          • Instruction Fuzzy Hash: 90D09230604201AFDB498F61C948E1ABBA2FF94705B218569E14A8A121DB36DC12FB09
                                                                                          APIs
                                                                                          • HeapAlloc.KERNEL32(00000008,?,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 004404B3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeap
                                                                                          • String ID:
                                                                                          • API String ID: 4292702814-0
                                                                                          • Opcode ID: 01f95fa899df11d1080725241b0b4b61d453ed8a0cb801d7c4739f7d0c0eaaa5
                                                                                          • Instruction ID: adc2634c1200e45e714ed67caed98ca82552da465de25bdde6cf026d531048eb
                                                                                          • Opcode Fuzzy Hash: 01f95fa899df11d1080725241b0b4b61d453ed8a0cb801d7c4739f7d0c0eaaa5
                                                                                          • Instruction Fuzzy Hash: 8F019C329416106AF62132396C42B1F62049BD47B9F19013BFF94673D1DB7C8C1041ED
                                                                                          APIs
                                                                                          • GetPropA.USER32(?,?), ref: 00446495
                                                                                          • CallWindowProcA.USER32(00000000), ref: 004464B7
                                                                                            • Part of subcall function 004451A0: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 004451C6
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451DE
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451EA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Prop$CallProcRemoveWindow
                                                                                          • String ID: #32770
                                                                                          • API String ID: 2276450057-463685578
                                                                                          • Opcode ID: d401baf3cd7b3aee5d81e0aadc34e4f5ff4fbb4171b39d3798e25316efd6867b
                                                                                          • Instruction ID: 457c202e7eb6f03a4ebcc3b3b201f36137c8d2e780467981c2f6a96860f55ec2
                                                                                          • Opcode Fuzzy Hash: d401baf3cd7b3aee5d81e0aadc34e4f5ff4fbb4171b39d3798e25316efd6867b
                                                                                          • Instruction Fuzzy Hash: E68106727013047BF610AB51EC45EAF7B5CEB877AAF410427FA0182242D72EA95587BB
                                                                                          APIs
                                                                                          • CallWindowProcA.USER32(00000000,00000000,?,?,?), ref: 00445CDA
                                                                                          • DefWindowProcA.USER32(00000000,?,?,?), ref: 00445CED
                                                                                          • IsIconic.USER32(00000000), ref: 00445D0F
                                                                                          • SendMessageA.USER32(00000000,000011EF,00000000,00000001), ref: 00445D3C
                                                                                          • GetWindowLongA.USER32(00000000,000000F0), ref: 00445D4B
                                                                                          • GetWindowDC.USER32(00000000), ref: 00445D8C
                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00445D9A
                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00445DDD
                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00445E00
                                                                                          • SelectObject.GDI32(00000000,?), ref: 00445E0E
                                                                                          • OffsetRect.USER32(?,?,00000000), ref: 00445E64
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Rect$InflateProc$CallIconicLongMessageObjectOffsetSelectSend
                                                                                          • String ID:
                                                                                          • API String ID: 2215177122-0
                                                                                          • Opcode ID: d8f9f0c745f05ba1946788c8a54dd7b414f0a3f8a30aa5e2c8a4a1444be3d149
                                                                                          • Instruction ID: f28eebd1f212b362638bd44b62d20611a207f861f1ea0de7a376724fb626dd8d
                                                                                          • Opcode Fuzzy Hash: d8f9f0c745f05ba1946788c8a54dd7b414f0a3f8a30aa5e2c8a4a1444be3d149
                                                                                          • Instruction Fuzzy Hash: FF816A71504300AFD704CF69DC85E6BB7E4FB89318F004A2EF94587292D775EA05CBA6
                                                                                          APIs
                                                                                          • FindResourceA.KERNEL32(?,?,00000002), ref: 00448503
                                                                                          • SizeofResource.KERNEL32(?,00000000,?,75C04920,00000000,75BFCF90,?,?,?,?,?,?,?,?,00446141,00000001), ref: 0044851D
                                                                                          • LoadResource.KERNEL32(?,00000000,?,75C04920,00000000,75BFCF90,?,?,?,?,?,?,?,?,00446141,00000001), ref: 00448527
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$FindLoadSizeof
                                                                                          • String ID:
                                                                                          • API String ID: 507330600-0
                                                                                          • Opcode ID: 39588da8ef6fdac34c6b5c25a8ca6eadd7a752f6fdecd25afedabb31a1faf28b
                                                                                          • Instruction ID: 69a1ef664918377817d479962ed057f5776313335b265a0253bc5ca9bdca108d
                                                                                          • Opcode Fuzzy Hash: 39588da8ef6fdac34c6b5c25a8ca6eadd7a752f6fdecd25afedabb31a1faf28b
                                                                                          • Instruction Fuzzy Hash: CD41BD326043145BE70CCE2AA856AAF77D2EBC9351F048A3EF94683381DF75D509C2A5
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 0044FB45
                                                                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 0044FB63
                                                                                          • lstrcpynW.KERNEL32(?,?,00000104), ref: 0044FB72
                                                                                          • GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0044FBA6
                                                                                          • CharUpperW.USER32(?), ref: 0044FBB7
                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 0044FBCD
                                                                                          • FindClose.KERNEL32(00000000), ref: 0044FBD9
                                                                                          • lstrcpyW.KERNEL32(?,?), ref: 0044FBE9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$CharCloseFileFirstFullH_prologInformationNamePathUpperVolumelstrcpylstrcpyn
                                                                                          • String ID:
                                                                                          • API String ID: 304730633-0
                                                                                          • Opcode ID: 417a633074dd335af4267d97e4ef1fc8f9f44caef3da8fd48ca5ec01ec69eb6a
                                                                                          • Instruction ID: b970325f901655d58795f90bdd7876ee210694483f3ee29ee8fd78757a5590c8
                                                                                          • Opcode Fuzzy Hash: 417a633074dd335af4267d97e4ef1fc8f9f44caef3da8fd48ca5ec01ec69eb6a
                                                                                          • Instruction Fuzzy Hash: 4021AC31500118ABDB209F66CC08EEF7FBCEF05361F108176F919D60A1D3389A49CBA4
                                                                                          APIs
                                                                                            • Part of subcall function 0044DAB9: GetWindowLongW.USER32(?,000000F0), ref: 0044DAC5
                                                                                          • GetKeyState.USER32(00000010), ref: 0044CE7F
                                                                                          • GetKeyState.USER32(00000011), ref: 0044CE88
                                                                                          • GetKeyState.USER32(00000012), ref: 0044CE91
                                                                                          • SendMessageW.USER32(?,00000111,0000E146,00000000), ref: 0044CEA7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: State$LongMessageSendWindow
                                                                                          • String ID:
                                                                                          • API String ID: 1063413437-0
                                                                                          • Opcode ID: 45e9338068b1a24f42502c37e8b6fac1d9cdeda2f4eca1f8ef133d868c681fea
                                                                                          • Instruction ID: 24e7347be8cbd19a04b139219c1227333f89b293c7d17d402ec6ac0322f2d1ba
                                                                                          • Opcode Fuzzy Hash: 45e9338068b1a24f42502c37e8b6fac1d9cdeda2f4eca1f8ef133d868c681fea
                                                                                          • Instruction Fuzzy Hash: 7EF0273274135A26F57076961C82FFA11244F40FD4F28043BBB01AE1D39BF8CC8286B8
                                                                                          APIs
                                                                                          • MonitorFromWindow.USER32(?,?), ref: 00431956
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FromMonitorWindow
                                                                                          • String ID:
                                                                                          • API String ID: 721739931-0
                                                                                          • Opcode ID: 2ec5084833ec79e04835300561dcfc710f9f77e819a17115442d49ad9b0581d5
                                                                                          • Instruction ID: 9b4ceeeaa9ed97c4064a6698ee8ca913d4a98661d6d4ce614f2e82711c0c1760
                                                                                          • Opcode Fuzzy Hash: 2ec5084833ec79e04835300561dcfc710f9f77e819a17115442d49ad9b0581d5
                                                                                          • Instruction Fuzzy Hash: B5F03171500109AFDF056FA2CC54AAE7B78AF08396F049027FC16D5131EB39CA15DB6E
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 0042E527
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042E56D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042E58E
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042E5D4
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042E659
                                                                                          • GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 0042E66A
                                                                                          • GdipCreateFontFamilyFromName.GDIPLUS(Arial,00000000,?,00000000,00000000,?), ref: 0042E682
                                                                                          • GdipCreateFont.GDIPLUS(?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0042E6AC
                                                                                          • GdipCreateFromHDC.GDIPLUS(?,?,?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0042E6CB
                                                                                          • GdipCreateSolidFill.GDIPLUS(FF000000,?,00000006,?,?,?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0042E70D
                                                                                          • LoadStringW.USER32(10000000,00000014,?,00000104), ref: 0042E768
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 0042E774
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,00000000,?,00000000), ref: 0042E78A
                                                                                          • GdipSetStringFormatFlags.GDIPLUS(?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 0042E7A3
                                                                                          • GdipSetStringFormatTrimming.GDIPLUS(?,00000004,?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 0042E7B7
                                                                                          • GdipSetTextRenderingHint.GDIPLUS(?,00000000,?,00000004,?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 0042E7CA
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000004,?,00001000,00000000,?,00000001), ref: 0042E816
                                                                                          • GdipCreateFont.GDIPLUS(?,41400000,00000000,00000002,?,?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000004), ref: 0042E843
                                                                                          • LoadStringW.USER32(10000000,00000015,?,00000104), ref: 0042E8CD
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 0042E8D9
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(?,00000000,00000000,?,00000000), ref: 0042E8EE
                                                                                          • GdipSetStringFormatFlags.GDIPLUS(?,00000020,00000000,?,00000000,00000000,?,00000000), ref: 0042E904
                                                                                          • GdipSetTextRenderingHint.GDIPLUS(?,00000000,?,00000020,00000000,?,00000000,00000000,?,00000000), ref: 0042E917
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000020,00000000,?,00000000,00000000,?), ref: 0042E963
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042E99C
                                                                                          • DeleteObject.GDI32(?), ref: 0042EA01
                                                                                          • DeleteObject.GDI32(?), ref: 0042EA08
                                                                                          • DeleteObject.GDI32(?), ref: 0042EA0F
                                                                                          • DeleteObject.GDI32(?), ref: 0042EA16
                                                                                          • ReleaseDC.USER32(?,?), ref: 0042EA28
                                                                                          • DeleteObject.GDI32(?), ref: 0042EA33
                                                                                          • DeleteObject.GDI32(0045EA8C), ref: 0042EA3A
                                                                                          • GdipDeleteFont.GDIPLUS(?), ref: 0042EA41
                                                                                          • GdipDeleteBrush.GDIPLUS(?,?), ref: 0042EA53
                                                                                          • GdipDeleteGraphics.GDIPLUS(?,?,?), ref: 0042EA5D
                                                                                          • GdipDeleteFont.GDIPLUS(?,?,?,?), ref: 0042EA67
                                                                                          • GdipDeleteFontFamily.GDIPLUS(?,?,?,?,?), ref: 0042EA71
                                                                                          • GdipDeleteStringFormat.GDIPLUS(?,?,?,?,?,?), ref: 0042EA7B
                                                                                            • Part of subcall function 00450CD6: __EH_prolog.LIBCMT ref: 00450CDB
                                                                                            • Part of subcall function 00450CD6: DeleteDC.GDI32(00000000), ref: 00450CFA
                                                                                            • Part of subcall function 00451481: __EH_prolog.LIBCMT ref: 00451486
                                                                                            • Part of subcall function 00451481: EndPaint.USER32(?,?,00000000,?,00401171,?,00000000), ref: 004514A3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Gdip$DeleteString$CreateFormat$FontObject$Align$CompatibleH_prolog$DrawFamilyFlagsFromHintLineLoadPaintRenderingText$BeginBitmapBrushClientFillGraphicsNameRectReleaseSolidTrimming
                                                                                          • String ID: Arial$`=@$hE
                                                                                          • API String ID: 4146303805-2905065322
                                                                                          • Opcode ID: 0e9ef12214aa1f89351732a9d0e38556700ad9b141871dfb26344f6713f31498
                                                                                          • Instruction ID: 599e33a8e558d1e1734f319df4ce7265ef0a8cf99e834b214a97d2cd341ddd9f
                                                                                          • Opcode Fuzzy Hash: 0e9ef12214aa1f89351732a9d0e38556700ad9b141871dfb26344f6713f31498
                                                                                          • Instruction Fuzzy Hash: EA023CB1118345AFD324DF65C881EABB7E8BFC8708F104E1EB59583251DB78E948CB66
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 00430787
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004307CD
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004307EE
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00430834
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 004308B9
                                                                                          • GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 004308CA
                                                                                          • GdipCreateFontFamilyFromName.GDIPLUS(Arial,00000000,?,00000000,00000000,?), ref: 004308E2
                                                                                          • GdipCreateFont.GDIPLUS(?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0043090C
                                                                                          • GdipCreateFromHDC.GDIPLUS(?,?,?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0043092B
                                                                                          • GdipCreateSolidFill.GDIPLUS(FF000000,?,00000006,?,?,?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0043096D
                                                                                          • LoadStringW.USER32(10000000,00000014,?,00000104), ref: 004309C8
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 004309D4
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,00000000,?,00000000), ref: 004309EA
                                                                                          • GdipSetStringFormatFlags.GDIPLUS(?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 00430A03
                                                                                          • GdipSetStringFormatTrimming.GDIPLUS(?,00000004,?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 00430A17
                                                                                          • GdipSetTextRenderingHint.GDIPLUS(?,00000000,?,00000004,?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 00430A2A
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000004,?,00001000,00000000,?,00000001), ref: 00430A76
                                                                                          • GdipCreateFont.GDIPLUS(?,41400000,00000000,00000002,?,?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000004), ref: 00430AA3
                                                                                          • LoadStringW.USER32(10000000,0000001B,?,00000104), ref: 00430B2D
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 00430B39
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(?,00000000,00000000,?,00000000), ref: 00430B4E
                                                                                          • GdipSetStringFormatFlags.GDIPLUS(?,00000020,00000000,?,00000000,00000000,?,00000000), ref: 00430B64
                                                                                          • GdipSetTextRenderingHint.GDIPLUS(?,00000000,?,00000020,00000000,?,00000000,00000000,?,00000000), ref: 00430B77
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000020,00000000,?,00000000,00000000,?), ref: 00430BC3
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 00430BFC
                                                                                          • DeleteObject.GDI32(?), ref: 00430C61
                                                                                          • DeleteObject.GDI32(?), ref: 00430C68
                                                                                          • DeleteObject.GDI32(?), ref: 00430C6F
                                                                                          • DeleteObject.GDI32(?), ref: 00430C76
                                                                                          • ReleaseDC.USER32(?,?), ref: 00430C88
                                                                                          • DeleteObject.GDI32(?), ref: 00430C93
                                                                                          • DeleteObject.GDI32(0045EA8C), ref: 00430C9A
                                                                                          • GdipDeleteFont.GDIPLUS(?), ref: 00430CA1
                                                                                          • GdipDeleteBrush.GDIPLUS(?,?), ref: 00430CB3
                                                                                          • GdipDeleteGraphics.GDIPLUS(?,?,?), ref: 00430CBD
                                                                                          • GdipDeleteFont.GDIPLUS(?,?,?,?), ref: 00430CC7
                                                                                          • GdipDeleteFontFamily.GDIPLUS(?,?,?,?,?), ref: 00430CD1
                                                                                          • GdipDeleteStringFormat.GDIPLUS(?,?,?,?,?,?), ref: 00430CDB
                                                                                            • Part of subcall function 00450CD6: __EH_prolog.LIBCMT ref: 00450CDB
                                                                                            • Part of subcall function 00450CD6: DeleteDC.GDI32(00000000), ref: 00450CFA
                                                                                            • Part of subcall function 00451481: __EH_prolog.LIBCMT ref: 00451486
                                                                                            • Part of subcall function 00451481: EndPaint.USER32(?,?,00000000,?,00401171,?,00000000), ref: 004514A3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Gdip$DeleteString$CreateFormat$FontObject$Align$CompatibleH_prolog$DrawFamilyFlagsFromHintLineLoadPaintRenderingText$BeginBitmapBrushClientFillGraphicsNameRectReleaseSolidTrimming
                                                                                          • String ID: Arial$`=@$hE
                                                                                          • API String ID: 4146303805-2905065322
                                                                                          • Opcode ID: 85b00a29f6364dc52c83532e757a8a44a7db669fd39ae0f226bfbe7b523b609e
                                                                                          • Instruction ID: fee2f3eecf4747f9b71248e8b11b50fbe35f60238ee9e8a2492da0127eddeec9
                                                                                          • Opcode Fuzzy Hash: 85b00a29f6364dc52c83532e757a8a44a7db669fd39ae0f226bfbe7b523b609e
                                                                                          • Instruction Fuzzy Hash: 21022CB1118345AFD324DF65C881FABB7E8BBC8708F104E1EB59583251DB78E909CB66
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 0042F6B7
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042F6FD
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042F71E
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042F764
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042F7E9
                                                                                          • GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 0042F7FA
                                                                                          • GdipCreateFontFamilyFromName.GDIPLUS(Arial,00000000,?,00000000,00000000,?), ref: 0042F812
                                                                                          • GdipCreateFont.GDIPLUS(?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0042F83C
                                                                                          • GdipCreateFromHDC.GDIPLUS(?,?,?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0042F85B
                                                                                          • GdipCreateSolidFill.GDIPLUS(FF000000,?,00000006,?,?,?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 0042F89D
                                                                                          • LoadStringW.USER32(10000000,0000001D,?,00000104), ref: 0042F8F8
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 0042F904
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,00000000,?,00000000), ref: 0042F91A
                                                                                          • GdipSetStringFormatFlags.GDIPLUS(?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 0042F933
                                                                                          • GdipSetStringFormatTrimming.GDIPLUS(?,00000004,?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 0042F947
                                                                                          • GdipSetTextRenderingHint.GDIPLUS(?,00000000,?,00000004,?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 0042F95A
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000004,?,00001000,00000000,?,00000001), ref: 0042F9A6
                                                                                          • GdipCreateFont.GDIPLUS(?,41400000,00000000,00000002,?,?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000004), ref: 0042F9D3
                                                                                          • LoadStringW.USER32(10000000,0000001E,?,00000104), ref: 0042FA5D
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 0042FA69
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(?,00000000,00000000,?,00000000), ref: 0042FA7E
                                                                                          • GdipSetStringFormatFlags.GDIPLUS(?,00000020,00000000,?,00000000,00000000,?,00000000), ref: 0042FA94
                                                                                          • GdipSetTextRenderingHint.GDIPLUS(?,00000000,?,00000020,00000000,?,00000000,00000000,?,00000000), ref: 0042FAA7
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000020,00000000,?,00000000,00000000,?), ref: 0042FAF3
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042FB2C
                                                                                          • DeleteObject.GDI32(?), ref: 0042FB91
                                                                                          • DeleteObject.GDI32(?), ref: 0042FB98
                                                                                          • DeleteObject.GDI32(?), ref: 0042FB9F
                                                                                          • DeleteObject.GDI32(?), ref: 0042FBA6
                                                                                          • ReleaseDC.USER32(?,?), ref: 0042FBB8
                                                                                          • DeleteObject.GDI32(?), ref: 0042FBC3
                                                                                          • DeleteObject.GDI32(0045EA8C), ref: 0042FBCA
                                                                                          • GdipDeleteFont.GDIPLUS(?), ref: 0042FBD1
                                                                                          • GdipDeleteBrush.GDIPLUS(?,?), ref: 0042FBE3
                                                                                          • GdipDeleteGraphics.GDIPLUS(?,?,?), ref: 0042FBED
                                                                                          • GdipDeleteFont.GDIPLUS(?,?,?,?), ref: 0042FBF7
                                                                                          • GdipDeleteFontFamily.GDIPLUS(?,?,?,?,?), ref: 0042FC01
                                                                                          • GdipDeleteStringFormat.GDIPLUS(?,?,?,?,?,?), ref: 0042FC0B
                                                                                            • Part of subcall function 00450CD6: __EH_prolog.LIBCMT ref: 00450CDB
                                                                                            • Part of subcall function 00450CD6: DeleteDC.GDI32(00000000), ref: 00450CFA
                                                                                            • Part of subcall function 00451481: __EH_prolog.LIBCMT ref: 00451486
                                                                                            • Part of subcall function 00451481: EndPaint.USER32(?,?,00000000,?,00401171,?,00000000), ref: 004514A3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Gdip$DeleteString$CreateFormat$FontObject$Align$CompatibleH_prolog$DrawFamilyFlagsFromHintLineLoadPaintRenderingText$BeginBitmapBrushClientFillGraphicsNameRectReleaseSolidTrimming
                                                                                          • String ID: Arial$`=@$hE
                                                                                          • API String ID: 4146303805-2905065322
                                                                                          • Opcode ID: a5501e5d28ddd7d03f6830976a2b94e80e90e21d7175c4621b55497643f8b9ef
                                                                                          • Instruction ID: af3c4e6d11a1fb14ee36ba1897fbe1e850a801f554f81c65bf61cae9d747c066
                                                                                          • Opcode Fuzzy Hash: a5501e5d28ddd7d03f6830976a2b94e80e90e21d7175c4621b55497643f8b9ef
                                                                                          • Instruction Fuzzy Hash: F5024DB1118345AFD324DF65C881FABB7E8BBC8708F104E2EB59583251DB78E908CB56
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 004158E7
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0041592D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0041594E
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00415994
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 00415A19
                                                                                          • GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 00415A2A
                                                                                          • GdipCreateFontFamilyFromName.GDIPLUS(Arial,00000000,?,00000000,00000000,?), ref: 00415A42
                                                                                          • GdipCreateFont.GDIPLUS(?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 00415A6C
                                                                                          • GdipCreateFromHDC.GDIPLUS(?,?,?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 00415A8B
                                                                                          • GdipCreateSolidFill.GDIPLUS(FF000000,?,00000006,?,?,?,41400000,00000001,00000002,?,Arial,00000000,?,00000000,00000000,?), ref: 00415ACD
                                                                                          • LoadStringW.USER32(10000000,00000014,?,00000104), ref: 00415B28
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 00415B34
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,00000000,?,00000000), ref: 00415B4A
                                                                                          • GdipSetStringFormatFlags.GDIPLUS(?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 00415B63
                                                                                          • GdipSetStringFormatTrimming.GDIPLUS(?,00000004,?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 00415B77
                                                                                          • GdipSetTextRenderingHint.GDIPLUS(?,00000000,?,00000004,?,00001000,00000000,?,00000001,00000000,?,00000000), ref: 00415B8A
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000004,?,00001000,00000000,?,00000001), ref: 00415BD6
                                                                                          • GdipCreateFont.GDIPLUS(?,41400000,00000000,00000002,?,?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000004), ref: 00415C03
                                                                                          • LoadStringW.USER32(10000000,00000019,?,00000104), ref: 00415C8D
                                                                                          • GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 00415C99
                                                                                          • GdipSetStringFormatLineAlign.GDIPLUS(?,00000000,00000000,?,00000000), ref: 00415CAE
                                                                                          • GdipSetStringFormatFlags.GDIPLUS(?,00000020,00000000,?,00000000,00000000,?,00000000), ref: 00415CC4
                                                                                          • GdipSetTextRenderingHint.GDIPLUS(?,00000000,?,00000020,00000000,?,00000000,00000000,?,00000000), ref: 00415CD7
                                                                                          • GdipDrawString.GDIPLUS(?,?,000000FF,?,?,?,0045EA8C,?,00000000,?,00000020,00000000,?,00000000,00000000,?), ref: 00415D23
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 00415D5C
                                                                                          • DeleteObject.GDI32(?), ref: 00415DC1
                                                                                          • DeleteObject.GDI32(?), ref: 00415DC8
                                                                                          • DeleteObject.GDI32(?), ref: 00415DCF
                                                                                          • DeleteObject.GDI32(?), ref: 00415DD6
                                                                                          • ReleaseDC.USER32(?,?), ref: 00415DE8
                                                                                          • DeleteObject.GDI32(?), ref: 00415DF3
                                                                                          • DeleteObject.GDI32(0045EA8C), ref: 00415DFA
                                                                                          • GdipDeleteFont.GDIPLUS(?), ref: 00415E01
                                                                                          • GdipDeleteBrush.GDIPLUS(?,?), ref: 00415E13
                                                                                          • GdipDeleteGraphics.GDIPLUS(?,?,?), ref: 00415E1D
                                                                                          • GdipDeleteFont.GDIPLUS(?,?,?,?), ref: 00415E27
                                                                                          • GdipDeleteFontFamily.GDIPLUS(?,?,?,?,?), ref: 00415E31
                                                                                          • GdipDeleteStringFormat.GDIPLUS(?,?,?,?,?,?), ref: 00415E3B
                                                                                            • Part of subcall function 00450CD6: __EH_prolog.LIBCMT ref: 00450CDB
                                                                                            • Part of subcall function 00450CD6: DeleteDC.GDI32(00000000), ref: 00450CFA
                                                                                            • Part of subcall function 00451481: __EH_prolog.LIBCMT ref: 00451486
                                                                                            • Part of subcall function 00451481: EndPaint.USER32(?,?,00000000,?,00401171,?,00000000), ref: 004514A3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Gdip$DeleteString$CreateFormat$FontObject$Align$CompatibleH_prolog$DrawFamilyFlagsFromHintLineLoadPaintRenderingText$BeginBitmapBrushClientFillGraphicsNameRectReleaseSolidTrimming
                                                                                          • String ID: Arial$`=@$hE
                                                                                          • API String ID: 4146303805-2905065322
                                                                                          • Opcode ID: 460178c6e51c6d0db82f2e4fd2c2a6ed37ce4b6e58745dd62cb413d2920aec42
                                                                                          • Instruction ID: fedc5fca61270e8c2b8c075d23e2fa5768937b4679ebb25201a89856e2d82e4d
                                                                                          • Opcode Fuzzy Hash: 460178c6e51c6d0db82f2e4fd2c2a6ed37ce4b6e58745dd62cb413d2920aec42
                                                                                          • Instruction Fuzzy Hash: 43024CB1108345AFD324DF65C881FABB7E8BBC8708F104E1EB59583251DB78E948CB66
                                                                                          APIs
                                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 0041948E
                                                                                          • GetObjectW.GDI32(?,00000018,?), ref: 004194B0
                                                                                          • CreateDIBSection.GDI32 ref: 00419520
                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 00419536
                                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 00419545
                                                                                          • GetObjectW.GDI32(00000000,00000018,?), ref: 00419562
                                                                                          • SelectObject.GDI32(?,?), ref: 0041959B
                                                                                          • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 004195C2
                                                                                          • GlobalAlloc.KERNEL32(00000042,00000660), ref: 004195D7
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 004195E4
                                                                                          • SetRect.USER32(00000010,7FFFFFFF,7FFFFFFF,00000000,00000000), ref: 0041960D
                                                                                          • GlobalUnlock.KERNEL32(?), ref: 00419749
                                                                                          • GlobalReAlloc.KERNEL32(?,?,00000002), ref: 0041976B
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00419776
                                                                                          • SetRect.USER32(?,?,00000000,00000001,00000001), ref: 00419795
                                                                                          • ExtCreateRegion.GDI32(00000000,?,00000000), ref: 004197E2
                                                                                          • CombineRgn.GDI32(00000064,00000064,00000000,00000002), ref: 004197F7
                                                                                          • DeleteObject.GDI32(00000000), ref: 004197FE
                                                                                          • SetRect.USER32(00000010,7FFFFFFF,7FFFFFFF,00000000,00000000), ref: 00419820
                                                                                          • ExtCreateRegion.GDI32(00000000,-00000002,00000000), ref: 0041986F
                                                                                          • CombineRgn.GDI32(00000064,00000064,00000000,00000002), ref: 00419884
                                                                                          • DeleteObject.GDI32(00000000), ref: 0041988B
                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00419898
                                                                                          • GlobalFree.KERNEL32(00000000), ref: 0041989F
                                                                                          • SelectObject.GDI32(?,?), ref: 004198AB
                                                                                          • DeleteDC.GDI32(?), ref: 004198B2
                                                                                          • SelectObject.GDI32(00000000,?), ref: 004198C2
                                                                                          • DeleteObject.GDI32(00000000), ref: 004198C9
                                                                                          • DeleteDC.GDI32(00000000), ref: 004198D4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Object$Global$CreateDelete$Select$Rect$AllocCombineCompatibleLockRegionUnlock$FreeSection
                                                                                          • String ID: $($d
                                                                                          • API String ID: 1200039244-2782573519
                                                                                          • Opcode ID: 85bd70445668b40b60c6c3aa63c1c28abde64228a465019c2db6404386c6eb94
                                                                                          • Instruction ID: 06b898c6524134f1f4ffdbf0c4963d387a87b0c4c790f3b8365633d6a7ea5d59
                                                                                          • Opcode Fuzzy Hash: 85bd70445668b40b60c6c3aa63c1c28abde64228a465019c2db6404386c6eb94
                                                                                          • Instruction Fuzzy Hash: 14D1AC716083419FD328CF29C894B9BBBE9EF89700F04492DF59AC3391D674E945CB6A
                                                                                          APIs
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 004470C4
                                                                                          • GetParent.USER32(?), ref: 004470DD
                                                                                          • SetBkMode.GDI32(?,00000002), ref: 004470ED
                                                                                          • GetClientRect.USER32(?,?), ref: 004470FF
                                                                                          • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 00447127
                                                                                          • SelectObject.GDI32(?,00000000), ref: 00447137
                                                                                            • Part of subcall function 00446D70: InflateRect.USER32(?,000000FF,000000FF), ref: 00446DB2
                                                                                            • Part of subcall function 00446D70: IsWindowEnabled.USER32(?), ref: 00446DC5
                                                                                            • Part of subcall function 00446D70: InflateRect.USER32(?,000000FF,000000FF), ref: 00446DEC
                                                                                            • Part of subcall function 00446D70: PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 00446E03
                                                                                            • Part of subcall function 00446D70: PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 00446E1C
                                                                                            • Part of subcall function 00446D70: PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 00446E34
                                                                                            • Part of subcall function 00446D70: PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 00446E4E
                                                                                            • Part of subcall function 00446D70: SelectObject.GDI32(?,?), ref: 00446E73
                                                                                          • GetSysColor.USER32(0000000F), ref: 00447149
                                                                                          • SetBkColor.GDI32(?,00000000), ref: 0044714D
                                                                                          • GetSysColor.USER32(00000012), ref: 00447155
                                                                                          • SetTextColor.GDI32(?,00000000), ref: 00447159
                                                                                          • SendMessageA.USER32(?,00000135,?,?), ref: 0044716B
                                                                                          • SelectObject.GDI32(?,00000000), ref: 00447173
                                                                                          • IntersectClipRect.GDI32(?,?,?,?,?), ref: 00447198
                                                                                          • PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 004471D0
                                                                                          • IsWindowEnabled.USER32(?), ref: 004471D7
                                                                                          • SendMessageA.USER32(?,000000F2,00000000,00000000), ref: 004471EB
                                                                                          • GetWindowTextA.USER32(?,?,00000100), ref: 00447259
                                                                                          • SelectObject.GDI32(?,?), ref: 004475AF
                                                                                          • SelectObject.GDI32(?,00000000), ref: 004475C2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ObjectSelect$ColorRectWindow$MessageSend$EnabledInflateText$ClientClipIntersectLongModeParent
                                                                                          • String ID:
                                                                                          • API String ID: 2549663215-0
                                                                                          • Opcode ID: e15d5e8a1b66d822045f5d1bdb4f7ff1e1e29f50b555a3ab0b528473777efeff
                                                                                          • Instruction ID: 17ec12c8e79f0e7f8bb66b0d0946fd03039384e1ff3f8962dbe082558f3131db
                                                                                          • Opcode Fuzzy Hash: e15d5e8a1b66d822045f5d1bdb4f7ff1e1e29f50b555a3ab0b528473777efeff
                                                                                          • Instruction Fuzzy Hash: 05F14B71108301AFE314DF64CC85E6FBBE8FB89705F00492DF58586291E7B8EA45CB6A
                                                                                          APIs
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 004478EE
                                                                                          • SendMessageA.USER32(?,00000157,00000000,00000000), ref: 0044791A
                                                                                          • HideCaret.USER32(?), ref: 00447930
                                                                                          • GetWindowRect.USER32(?,?), ref: 0044793C
                                                                                          • GetParent.USER32(?), ref: 00447943
                                                                                          • ScreenToClient.USER32(00000000,?), ref: 00447957
                                                                                          • ScreenToClient.USER32(00000000,?), ref: 00447963
                                                                                          • GetDC.USER32(00000000), ref: 00447966
                                                                                          • GetWindowLongA.USER32(?,000000F4), ref: 00447998
                                                                                          • SendMessageA.USER32(00000000,00001944,00000000,0000029A), ref: 004479C5
                                                                                          • SendMessageA.USER32(00000000,00001943,00000000,0000029A), ref: 004479E6
                                                                                          • GetClassNameA.USER32(00000000,?,00000010), ref: 004479F8
                                                                                          • lstrcmpA.KERNEL32(?,ComboBox), ref: 00447A08
                                                                                          • GetParent.USER32(00000000), ref: 00447A2C
                                                                                          • MapWindowPoints.USER32(00000000,0000029A,?,00000002), ref: 00447A43
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00447A4B
                                                                                          • GetDC.USER32(?), ref: 00447A56
                                                                                          • GetWindowLongA.USER32(00000000,000000F0), ref: 00447A6C
                                                                                          • GetWindow.USER32(00000000,00000005), ref: 00447A87
                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00447A93
                                                                                          • SendMessageA.USER32(00000000,00000157,00000000,00000000), ref: 00447AD0
                                                                                          • ReleaseDC.USER32(?,00000000), ref: 00447AE0
                                                                                          • ShowCaret.USER32(?), ref: 00447AE7
                                                                                          • GetSystemMetrics.USER32(00000002), ref: 00447B28
                                                                                          • GetSystemMetrics.USER32(00000002), ref: 00447B87
                                                                                          • GetSystemMetrics.USER32(00000015), ref: 00447BD8
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00447BFA
                                                                                          • ShowCaret.USER32(?), ref: 00447C08
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$MessageSend$CaretLongMetricsReleaseSystem$ClientParentRectScreenShow$ClassHideNamePointslstrcmp
                                                                                          • String ID: ComboBox
                                                                                          • API String ID: 930961256-1152790111
                                                                                          • Opcode ID: cf5d41845d2745417c56257340ac95e725c5c48aa25778beda509992a4164ce2
                                                                                          • Instruction ID: d7135a99e5b32207f2cdd928311edd6ed6e65b9364d86d6a446986ae2f183326
                                                                                          • Opcode Fuzzy Hash: cf5d41845d2745417c56257340ac95e725c5c48aa25778beda509992a4164ce2
                                                                                          • Instruction Fuzzy Hash: CA91A171508345AFE3109F65CC49F6FB7E8EB85709F00092EF64196292E778EA06CB5B
                                                                                          APIs
                                                                                          • RegisterClipboardFormatW.USER32(Native), ref: 0045472B
                                                                                          • RegisterClipboardFormatW.USER32(OwnerLink), ref: 00454734
                                                                                          • RegisterClipboardFormatW.USER32(ObjectLink), ref: 0045473E
                                                                                          • RegisterClipboardFormatW.USER32(Embedded Object), ref: 00454748
                                                                                          • RegisterClipboardFormatW.USER32(Embed Source), ref: 00454752
                                                                                          • RegisterClipboardFormatW.USER32(Link Source), ref: 0045475C
                                                                                          • RegisterClipboardFormatW.USER32(Object Descriptor), ref: 00454766
                                                                                          • RegisterClipboardFormatW.USER32(Link Source Descriptor), ref: 00454770
                                                                                          • RegisterClipboardFormatW.USER32(FileName), ref: 0045477A
                                                                                          • RegisterClipboardFormatW.USER32(FileNameW), ref: 00454784
                                                                                          • RegisterClipboardFormatW.USER32(Rich Text Format), ref: 0045478E
                                                                                          • RegisterClipboardFormatW.USER32(RichEdit Text and Objects), ref: 00454798
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClipboardFormatRegister
                                                                                          • String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
                                                                                          • API String ID: 1228543026-2889995556
                                                                                          • Opcode ID: 63f40f5629dcee61b27d3e886efdba6496d0f378891504e71da0c91c82ae3211
                                                                                          • Instruction ID: 868cd1ab3a839bbaeb3bacd4a80527a2b384454b9c36435715dfe5f1b2190607
                                                                                          • Opcode Fuzzy Hash: 63f40f5629dcee61b27d3e886efdba6496d0f378891504e71da0c91c82ae3211
                                                                                          • Instruction Fuzzy Hash: 66019BB0E407846A8730BF765C09957BEE0EEC5B123214D2FE08687641E6B8D649CF5A
                                                                                          APIs
                                                                                          • IsRectEmpty.USER32(?), ref: 0042B9B3
                                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 0042B9DC
                                                                                          • SelectObject.GDI32(?,?), ref: 0042BA05
                                                                                          • StretchBlt.GDI32(?,?,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0042BA65
                                                                                          • SelectObject.GDI32(?,00000000), ref: 0042BA75
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042BAD4
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042BAEC
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042BB04
                                                                                          • SelectObject.GDI32(?,?), ref: 0042BB64
                                                                                          • StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0042BB9A
                                                                                          • SelectObject.GDI32(?,?), ref: 0042BBB4
                                                                                          • SelectObject.GDI32(?,?), ref: 0042BBC9
                                                                                          • StretchBlt.GDI32(?,00000000,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0042BBF8
                                                                                          • SelectObject.GDI32(?,?), ref: 0042BC12
                                                                                          • SelectObject.GDI32(?,?), ref: 0042BC27
                                                                                          • StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0042BC5C
                                                                                          • SelectObject.GDI32(?,?), ref: 0042BDC9
                                                                                            • Part of subcall function 00450CC0: DeleteDC.GDI32(00000000), ref: 00450CCF
                                                                                            • Part of subcall function 00450CD6: __EH_prolog.LIBCMT ref: 00450CDB
                                                                                            • Part of subcall function 00450CD6: DeleteDC.GDI32(00000000), ref: 00450CFA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ObjectSelect$CompatibleCreateStretch$Delete$EmptyH_prologRect
                                                                                          • String ID:
                                                                                          • API String ID: 992754503-0
                                                                                          • Opcode ID: b1dd000a972b7dae90b856e182affd3b2a9175e023b8f4fea94a17e3cfead045
                                                                                          • Instruction ID: 41602959557307e2e0b499936c3d219bee8e30e2784b375addd5637488a61847
                                                                                          • Opcode Fuzzy Hash: b1dd000a972b7dae90b856e182affd3b2a9175e023b8f4fea94a17e3cfead045
                                                                                          • Instruction Fuzzy Hash: C3E14872268755AFD704CF75CC86E6BB7E9FB88704F104A2DB596C3280E778E8048B65
                                                                                          APIs
                                                                                            • Part of subcall function 00445280: SetBkColor.GDI32(?), ref: 0044529D
                                                                                            • Part of subcall function 00445280: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 004452EA
                                                                                            • Part of subcall function 00445280: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 00445319
                                                                                            • Part of subcall function 00445280: SetBkColor.GDI32(?,?), ref: 00445337
                                                                                            • Part of subcall function 00445280: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 00445362
                                                                                            • Part of subcall function 00445280: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044539C
                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00446DB2
                                                                                          • IsWindowEnabled.USER32(?), ref: 00446DC5
                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00446DEC
                                                                                          • PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 00446E03
                                                                                          • PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 00446E1C
                                                                                          • PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 00446E34
                                                                                          • PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 00446E4E
                                                                                          • SelectObject.GDI32(?,?), ref: 00446E73
                                                                                          • PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00446E97
                                                                                          • PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00446EB7
                                                                                          • SelectObject.GDI32(?,?), ref: 00446ECD
                                                                                          • PatBlt.GDI32(?,00000000,?,?,00000001,00F00021), ref: 00446EFB
                                                                                          • PatBlt.GDI32(?,00000000,00000000,00000001,00000000,00F00021), ref: 00446F1C
                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00446F32
                                                                                          • SelectObject.GDI32(?,?), ref: 00446F4C
                                                                                          • PatBlt.GDI32(?,00000000,?,?,?,00F00021), ref: 00446F74
                                                                                          • IsWindowEnabled.USER32(?), ref: 00446F7F
                                                                                          • SetTextColor.GDI32(?,?), ref: 00446F90
                                                                                          • OffsetRect.USER32(?,00000001,00000001), ref: 0044701C
                                                                                            • Part of subcall function 00445280: SetBkColor.GDI32(?,00000000), ref: 004453A4
                                                                                          • DrawTextA.USER32(?,?,?,?,00000020), ref: 00447054
                                                                                          • GetFocus.USER32 ref: 00447060
                                                                                          • InflateRect.USER32(?,00000001,00000001), ref: 00447071
                                                                                          • IntersectRect.USER32(?,?,?), ref: 00447082
                                                                                          • DrawFocusRect.USER32(?,?), ref: 0044708E
                                                                                          • SelectObject.GDI32(?,00000000), ref: 004470A1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Rect$Text$ColorInflateObjectSelect$DrawEnabledFocusWindow$IntersectOffset
                                                                                          • String ID:
                                                                                          • API String ID: 1611134597-0
                                                                                          • Opcode ID: bc4633ff33a95af42ff516029ff2cf29e5f2e0bcf89b91a79e87141a0ca26f81
                                                                                          • Instruction ID: 356cbaf972e7a0d0bed30d93c1d692beba62806130a9e93d628134cb7f9f8f72
                                                                                          • Opcode Fuzzy Hash: bc4633ff33a95af42ff516029ff2cf29e5f2e0bcf89b91a79e87141a0ca26f81
                                                                                          • Instruction Fuzzy Hash: EBB14971208301AFE304CF69CD85E6BB7E8FB89709F004A1DF659D3291C7B5EA458B66
                                                                                          APIs
                                                                                            • Part of subcall function 00422FC0: RegOpenKeyExW.KERNELBASE(004856F0,?,00000000,000F003F,?,00474CF0,004856F0,?,00424732,80000001,?,?,?,Control Panel\Mouse,00474CF0,004856F0), ref: 00422FD9
                                                                                            • Part of subcall function 00422FC0: RegCreateKeyW.ADVAPI32(004856F0,?,?), ref: 00422FEA
                                                                                          • wsprintfW.USER32 ref: 004236B4
                                                                                          • wsprintfW.USER32 ref: 004236DB
                                                                                          • wsprintfW.USER32 ref: 00423702
                                                                                          • wsprintfW.USER32 ref: 00423754
                                                                                          • wsprintfW.USER32 ref: 0042377B
                                                                                          • wsprintfW.USER32 ref: 004237A2
                                                                                          • RegCloseKey.ADVAPI32(?), ref: 004237C6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: wsprintf$CloseCreateOpen
                                                                                          • String ID: Control Panel\Desktop$Control Panel\Mouse$DoubleClickSpeed$MouseSensitivity$MouseSpeed$MouseThreshold1$MouseThreshold2$SwapMouseButtons$WheelScrollLines
                                                                                          • API String ID: 1131821687-3657349053
                                                                                          • Opcode ID: 858f51774acf5ef470cf0c8a001f6eebeab516eddb1cb4504646f8ae3820dc81
                                                                                          • Instruction ID: 950698575376246587b83f410f0d4e0a2933821a12a019b66155f6b74d5e778e
                                                                                          • Opcode Fuzzy Hash: 858f51774acf5ef470cf0c8a001f6eebeab516eddb1cb4504646f8ae3820dc81
                                                                                          • Instruction Fuzzy Hash: CB51E9B02043016FD610DF68DC81EBB73B8EFC4705F40892EFA5897155E67DEA098BA9
                                                                                          APIs
                                                                                          • GetPropA.USER32(?,?), ref: 00447645
                                                                                          • CallWindowProcA.USER32(00000000), ref: 0044766D
                                                                                            • Part of subcall function 004451A0: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 004451C6
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451DE
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Prop$CallProcRemoveWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2276450057-0
                                                                                          • Opcode ID: c5b988cf31ac463401cacab702b124df6e4e77ad16c042a3ad687f29afd2e318
                                                                                          • Instruction ID: 275fee56301676d4a89cffa9a0799e45ad12c91db2808b30a9bfa16a72370d2c
                                                                                          • Opcode Fuzzy Hash: c5b988cf31ac463401cacab702b124df6e4e77ad16c042a3ad687f29afd2e318
                                                                                          • Instruction Fuzzy Hash: FB611A766483146BF220A755EC49FAF375CEB86371F100536F90092392DB1DAA06C6BF
                                                                                          APIs
                                                                                          • SetRect.USER32(?,0000001A,00000008,00000033,00000013), ref: 00416EB4
                                                                                          • SetRect.USER32(?,00000038,00000008,00000051,00000013), ref: 00416EC5
                                                                                          • SetRect.USER32(?,00000054,00000008,0000006D,00000013), ref: 00416ED6
                                                                                          • SetRect.USER32(?,00000072,00000008,0000008A,00000013), ref: 00416EEA
                                                                                          • SetRect.USER32(?,0000008D,00000008,000000A6,00000013), ref: 00416F01
                                                                                          • SetRect.USER32(?,000000AA,00000008,000000C3,00000013), ref: 00416F18
                                                                                          • SetRect.USER32(?,000000C7,00000008,000000DF,00000013), ref: 00416F2F
                                                                                          • SetRect.USER32(?,000000E4,00000008,000000FB,00000013), ref: 00416F46
                                                                                          • SetRect.USER32(?,00000000,00000000,0000001A,0000001A), ref: 00416FBC
                                                                                          Strings
                                                                                          • C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\skins\, xrefs: 00417078
                                                                                          • scroll_arrow_down.bmp, xrefs: 00417098
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Rect
                                                                                          • String ID: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\skins\$scroll_arrow_down.bmp
                                                                                          • API String ID: 400858303-2083388722
                                                                                          • Opcode ID: c2503b20d99a791ad33f71e99d346b273ad3d411281fe5bf3d80fa7eb5a9dcd0
                                                                                          • Instruction ID: 40f3e2398531a85faeba378d8f070244b6d6d656068757b4fe64f1315c891f8e
                                                                                          • Opcode Fuzzy Hash: c2503b20d99a791ad33f71e99d346b273ad3d411281fe5bf3d80fa7eb5a9dcd0
                                                                                          • Instruction Fuzzy Hash: B3919D703843447BE224EF65CC52F9B7794BF94B04F10491DF6996A1C2DBB8B608CB6A
                                                                                          APIs
                                                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 0041C2A2
                                                                                          • SendMessageW.USER32(?,00000199,00000000,00000000), ref: 0041C2B2
                                                                                          • SendMessageW.USER32(?,00000198,00000000,?), ref: 0041C2DB
                                                                                          • InvalidateRect.USER32(?,?,00000001), ref: 0041C2E8
                                                                                          • SendMessageW.USER32(?,00000189,00000000,?), ref: 0041C317
                                                                                          • GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0041C33B
                                                                                          • CreateWindowExW.USER32(00000000,edit,?,50803080,?,?,?,?,?,00000000,00000000), ref: 0041C371
                                                                                          • SendMessageW.USER32(00000000,00000030,?,00000001), ref: 0041C38A
                                                                                          • lstrlenW.KERNEL32(?), ref: 0041C391
                                                                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0041C3A3
                                                                                          • SendMessageW.USER32(?,000000C5,00000014,00000000), ref: 0041C3B2
                                                                                          • SetFocus.USER32(?), ref: 0041C3B8
                                                                                          • SetWindowLongW.USER32(?,000000FC,Function_0001BCE0), ref: 0041C3CF
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend$Window$CreateFocusHandleInvalidateLongModuleRectlstrlen
                                                                                          • String ID: edit
                                                                                          • API String ID: 626028974-2167791130
                                                                                          • Opcode ID: 9fdfb620a879a31b321dc24a52b8986c9656d582a6594e14d6cb5d10865b4ac7
                                                                                          • Instruction ID: 5ab48e1037d6dde8d4e2977a8bd4ab1d026cfcd310ec1e2626f4220454c6aecc
                                                                                          • Opcode Fuzzy Hash: 9fdfb620a879a31b321dc24a52b8986c9656d582a6594e14d6cb5d10865b4ac7
                                                                                          • Instruction Fuzzy Hash: 7D417075244305BFE324CF59CC85F67B7E8FB88704F008A1DB64597290D6B4F9058B69
                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(USER32,?,?,?,0043194C), ref: 00431835
                                                                                          • GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 0043184D
                                                                                          • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0043185E
                                                                                          • GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0043186F
                                                                                          • GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 00431880
                                                                                          • GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 00431891
                                                                                          • GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 004318A2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$HandleModule
                                                                                          • String ID: EnumDisplayMonitors$GetMonitorInfoW$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
                                                                                          • API String ID: 667068680-2547861404
                                                                                          • Opcode ID: 503ff2fdb0b2e1177d5a7a4e6d1c2dbb28e654c2873ee37872b46a39dc0c430f
                                                                                          • Instruction ID: 4a88c8c2d6e8be11d269fc5d6c54d36176067699e67ee60cd02aa9256ed44448
                                                                                          • Opcode Fuzzy Hash: 503ff2fdb0b2e1177d5a7a4e6d1c2dbb28e654c2873ee37872b46a39dc0c430f
                                                                                          • Instruction Fuzzy Hash: D1112E70A04310AE9305AF6EACC293ABAA4B2AF740B68553FD004D23B4DB784447DB6D
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Focus$MessageParentStateWindow$BeepDialogH_prologItemNext
                                                                                          • String ID:
                                                                                          • API String ID: 1894107442-0
                                                                                          • Opcode ID: f1568a1caa8f5d3fbad2d1725cf25cbf85dfe02fbf805ddb06e15258f10115cb
                                                                                          • Instruction ID: a782cb2c459ea05ee3c08d66d9d2ffaf623fb6b4f52faf534a563a13cf509e1c
                                                                                          • Opcode Fuzzy Hash: f1568a1caa8f5d3fbad2d1725cf25cbf85dfe02fbf805ddb06e15258f10115cb
                                                                                          • Instruction Fuzzy Hash: 3CA19E71900306ABDF24AF62C945AAFF765EF08354F14601FF801A7261DF39ED81866D
                                                                                          APIs
                                                                                          • CopyRect.USER32(?,?), ref: 0041B8D2
                                                                                            • Part of subcall function 00452908: SendMessageW.USER32(?,0000018A,?,00000000), ref: 00452920
                                                                                            • Part of subcall function 00452908: SendMessageW.USER32(?,00000189,?,00000000), ref: 00452939
                                                                                          • GetTextExtentPoint32W.GDI32(?,00000000,?,?), ref: 0041B976
                                                                                            • Part of subcall function 00450E61: SetBkMode.GDI32(?,?), ref: 00450E7A
                                                                                            • Part of subcall function 00450E61: SetBkMode.GDI32(?,?), ref: 00450E88
                                                                                          • GetTextExtentPoint32W.GDI32(?,00000000,?,?), ref: 0041B9A2
                                                                                          • FillRect.USER32(?,?,?), ref: 0041B9F5
                                                                                          • FillRect.USER32(?,?,00461A98), ref: 0041BA38
                                                                                          • FillRect.USER32(?,?,00461A98), ref: 0041BA8D
                                                                                          • GetSysColor.USER32(00000010), ref: 0041BABA
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0041BAFB
                                                                                          • LoadBitmapW.USER32(?,?), ref: 0041BB32
                                                                                          • GetObjectW.GDI32(00000000,00000018,?), ref: 0041BB69
                                                                                          • TransparentBlt.MSIMG32(?,?,?,?,?,?,00000000,00000000,?,?,00000000), ref: 0041BB9F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Rect$Fill$ExtentMessageModePoint32SendText$BitmapColorCompatibleCopyCreateLoadObjectTransparent
                                                                                          • String ID: hE$hE
                                                                                          • API String ID: 29142947-2849566860
                                                                                          • Opcode ID: a27015652909dfb4b129ec06876d0615dc305b9b2ac27fa85bd3ec10fd88b8fd
                                                                                          • Instruction ID: 5e09b75e799de595eb1dba742794c7c22f5f0f889dc1f8c066c47888731f5173
                                                                                          • Opcode Fuzzy Hash: a27015652909dfb4b129ec06876d0615dc305b9b2ac27fa85bd3ec10fd88b8fd
                                                                                          • Instruction Fuzzy Hash: 64C14B752083459FD314CF65C884A6BB7E8FF88304F148A1EF99683361D774E949CB96
                                                                                          APIs
                                                                                            • Part of subcall function 00448D2A: __EH_prolog.LIBCMT ref: 00448D2F
                                                                                            • Part of subcall function 00448D2A: lstrcpynW.KERNEL32(?,?,00000104,00000206,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,?,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 00448E1E
                                                                                            • Part of subcall function 00448E91: lstrlenW.KERNEL32(?,?,?,?,?,?,0040E5E0), ref: 00448E9B
                                                                                            • Part of subcall function 00448E91: GetFocus.USER32 ref: 00448EC3
                                                                                            • Part of subcall function 00448E91: IsWindowEnabled.USER32(?), ref: 00448EEC
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000000), ref: 00448EFE
                                                                                            • Part of subcall function 00448E91: GetOpenFileNameW.COMDLG32(?,?,?), ref: 00448F29
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000001), ref: 00448F47
                                                                                            • Part of subcall function 00448E91: IsWindow.USER32(?), ref: 00448F4D
                                                                                            • Part of subcall function 00448E91: SetFocus.USER32(?), ref: 00448F5B
                                                                                            • Part of subcall function 00448F79: __EH_prolog.LIBCMT ref: 00448F7E
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 00448FBB
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000464,00000104,00000000), ref: 00448FE3
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 0044900C
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000465,00000104,00000000), ref: 00449029
                                                                                            • Part of subcall function 00449145: __EH_prolog.LIBCMT ref: 0044914A
                                                                                          • wsprintfW.USER32 ref: 00420B09
                                                                                          • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00420B55
                                                                                            • Part of subcall function 0044F29F: __EH_prolog.LIBCMT ref: 0044F2A4
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: H_prologWindow$MessageSend$EnableFocusParent$DecrementEnabledFileInterlockedNameOpenlstrcpynlstrlenwsprintf
                                                                                          • String ID: %s%d$%sconfig\.macro$*.macro$@JG$C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\$Macro(*.macro)|*.MACRO|$Macros$X
                                                                                          • API String ID: 3707860817-3292254151
                                                                                          • Opcode ID: 77b067c380e4b6a50f39f33de4e5c73adff1be17fd12dc31712cc22f5b38810d
                                                                                          • Instruction ID: 2de9f77b50ab06612c834039a9bad681aa8c7c8bbc27425e0776b330f931ad8e
                                                                                          • Opcode Fuzzy Hash: 77b067c380e4b6a50f39f33de4e5c73adff1be17fd12dc31712cc22f5b38810d
                                                                                          • Instruction Fuzzy Hash: 1581A670148380ABE334EB56D852FDFB7D4AB94708F44491EF589522C2DBB96508CB6B
                                                                                          APIs
                                                                                            • Part of subcall function 00448D2A: __EH_prolog.LIBCMT ref: 00448D2F
                                                                                            • Part of subcall function 00448D2A: lstrcpynW.KERNEL32(?,?,00000104,00000206,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,?,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 00448E1E
                                                                                            • Part of subcall function 00448E91: lstrlenW.KERNEL32(?,?,?,?,?,?,0040E5E0), ref: 00448E9B
                                                                                            • Part of subcall function 00448E91: GetFocus.USER32 ref: 00448EC3
                                                                                            • Part of subcall function 00448E91: IsWindowEnabled.USER32(?), ref: 00448EEC
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000000), ref: 00448EFE
                                                                                            • Part of subcall function 00448E91: GetOpenFileNameW.COMDLG32(?,?,?), ref: 00448F29
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000001), ref: 00448F47
                                                                                            • Part of subcall function 00448E91: IsWindow.USER32(?), ref: 00448F4D
                                                                                            • Part of subcall function 00448E91: SetFocus.USER32(?), ref: 00448F5B
                                                                                            • Part of subcall function 00448F79: __EH_prolog.LIBCMT ref: 00448F7E
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 00448FBB
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000464,00000104,00000000), ref: 00448FE3
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 0044900C
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000465,00000104,00000000), ref: 00449029
                                                                                            • Part of subcall function 00449145: __EH_prolog.LIBCMT ref: 0044914A
                                                                                          • DeleteFileW.KERNEL32(?,?,?,?,00000001,*.gmp,?,00001006,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 0040E3F8
                                                                                          • GetLastError.KERNEL32(?,?,?,00000001,*.gmp,?,00001006,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 0040E402
                                                                                          • CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000001,*.gmp,?,00001006,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 0040E414
                                                                                          • GetLastError.KERNEL32(?,?,?,00000001,*.gmp,?,00001006,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 0040E41E
                                                                                          • SetFileAttributesW.KERNEL32(?,00000022,?,?,?,00000001,*.gmp,?,00001006,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 0040E42B
                                                                                          • GetLastError.KERNEL32(?,?,?,00000001,*.gmp,?,00001006,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 0040E435
                                                                                            • Part of subcall function 0044F29F: __EH_prolog.LIBCMT ref: 0044F2A4
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileH_prologWindow$ErrorLast$EnableFocusMessageParentSend$AttributesCopyDecrementDeleteEnabledInterlockedNameOpenlstrcpynlstrlen
                                                                                          • String ID: %sconfig\%s.gmp$%sconfig\.gmp$*.gmp$C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\$Default%d$Gaming Mouse Profile(*.gmp)|*.gmp|$X
                                                                                          • API String ID: 3405621446-3340431197
                                                                                          • Opcode ID: 36b981551c36b320b3e179242828e5225ff524c810c78a378c2903b998f86c1e
                                                                                          • Instruction ID: 9d3b2da7af66c757a8783758416f32c174abdbc79e291eea147e5fc767ec5694
                                                                                          • Opcode Fuzzy Hash: 36b981551c36b320b3e179242828e5225ff524c810c78a378c2903b998f86c1e
                                                                                          • Instruction Fuzzy Hash: 947182741083819FE325EF26C855B9EB7E8BB94708F44491EF48D53282DF78A609CB67
                                                                                          APIs
                                                                                          • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 0041C10D
                                                                                            • Part of subcall function 0041B850: SendMessageW.USER32(?,00000181,?,?), ref: 0041B86E
                                                                                            • Part of subcall function 0041B850: SendMessageW.USER32(?,0000019A,?,?), ref: 0041B87F
                                                                                          • SendMessageW.USER32(?,00000198,00000000,?), ref: 0041C138
                                                                                          • InvalidateRect.USER32(?,?,00000001), ref: 0041C145
                                                                                          • SendMessageW.USER32(?,00000189,00000000,?), ref: 0041C189
                                                                                          • GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0041C192
                                                                                          • CreateWindowExW.USER32(00000000,edit,?,50801080,?,?,?,?,?,00000000,00000000), ref: 0041C1C8
                                                                                          • SendMessageW.USER32(00000000,00000030,?,00000001), ref: 0041C1E2
                                                                                          • lstrlenW.KERNEL32(?), ref: 0041C1E9
                                                                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0041C1FB
                                                                                          • SendMessageW.USER32(?,000000C5,0000000F,00000000), ref: 0041C20A
                                                                                          • SetFocus.USER32(?), ref: 0041C210
                                                                                          • SetWindowLongW.USER32(?,000000FC,Function_0001BCE0), ref: 0041C227
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend$Window$CreateFocusHandleInvalidateLongModuleRectlstrlen
                                                                                          • String ID: edit
                                                                                          • API String ID: 626028974-2167791130
                                                                                          • Opcode ID: dc3e8703d7e52aefb02ec56db13b19cdc9fc5cb2ebcb93b0104ffee5bcf822a2
                                                                                          • Instruction ID: b3a56dec6dce2e03b91eee3906b3305984b9eddd7a43e542e282e766b3b5e5f4
                                                                                          • Opcode Fuzzy Hash: dc3e8703d7e52aefb02ec56db13b19cdc9fc5cb2ebcb93b0104ffee5bcf822a2
                                                                                          • Instruction Fuzzy Hash: A1418F71244304BFE328CF65DC85F67B7E8FB88B04F004A2DBA8597290DAB4F9058B59
                                                                                          APIs
                                                                                            • Part of subcall function 00453FE7: TlsGetValue.KERNEL32(00498528,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36,?,00000000,?,0044869C,00000000,00000000,00000000,00000000), ref: 00454026
                                                                                          • RegisterClipboardFormatW.USER32(commdlg_LBSelChangedNotify), ref: 00449488
                                                                                          • RegisterClipboardFormatW.USER32(commdlg_ShareViolation), ref: 00449494
                                                                                          • RegisterClipboardFormatW.USER32(commdlg_FileNameOK), ref: 004494A0
                                                                                          • RegisterClipboardFormatW.USER32(commdlg_ColorOK), ref: 004494AC
                                                                                          • RegisterClipboardFormatW.USER32(commdlg_help), ref: 004494B8
                                                                                          • RegisterClipboardFormatW.USER32(commdlg_SetRGBColor), ref: 004494C4
                                                                                            • Part of subcall function 0044D9CB: SetWindowLongW.USER32(?,000000FC,00000000), ref: 0044D9FA
                                                                                          • SendMessageW.USER32(00000000,00000111,0000E146,00000000), ref: 004495B7
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClipboardFormatRegister$LongMessageSendValueWindow
                                                                                          • String ID: commdlg_ColorOK$commdlg_FileNameOK$commdlg_LBSelChangedNotify$commdlg_SetRGBColor$commdlg_ShareViolation$commdlg_help
                                                                                          • API String ID: 3913284445-3888057576
                                                                                          • Opcode ID: 94bdfb06fe4f4a4de5a44734e2f22c5b54f200e33a15ba7da4bf16287d890dae
                                                                                          • Instruction ID: 2e91ecf47de1e81e97d2a8f047930a047eb3678edaf848a7988c5ff47185409b
                                                                                          • Opcode Fuzzy Hash: 94bdfb06fe4f4a4de5a44734e2f22c5b54f200e33a15ba7da4bf16287d890dae
                                                                                          • Instruction Fuzzy Hash: 70418E72600204BBEB229F69DC49B6B3AA1EB54351F20047BF805572A1DB789D40DB9D
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: H_prologlstrlen
                                                                                          • String ID: `<u
                                                                                          • API String ID: 2133942097-3367579956
                                                                                          • Opcode ID: e3c3a1b229ae76c4e6286e0eef5a0d01d9e6d3f1b5b1dd20b8f7792031f479cd
                                                                                          • Instruction ID: ba261511a2ed193691f57ec8eae9f6b103d480a0d5c1f3580a170b8d4dc45dfe
                                                                                          • Opcode Fuzzy Hash: e3c3a1b229ae76c4e6286e0eef5a0d01d9e6d3f1b5b1dd20b8f7792031f479cd
                                                                                          • Instruction Fuzzy Hash: 8ED1B372D00609DFDF11DFA4D8846AEBBB1FF05315F14412AEC15AB352D738AA0ACB55
                                                                                          APIs
                                                                                          • CopyRect.USER32(?,?), ref: 00417AE1
                                                                                          • GetMenuState.USER32(?,?,00000000), ref: 00417B2C
                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00417BA0
                                                                                          • GetMenuState.USER32(?,?,00000000), ref: 00417C84
                                                                                          • LoadIconW.USER32(?,00000091), ref: 00417C9C
                                                                                          • DrawIcon.USER32(?,?,?,00000000), ref: 00417CBA
                                                                                          • DestroyIcon.USER32(00000000), ref: 00417CC1
                                                                                          • GetTextColor.GDI32(?), ref: 00417BFC
                                                                                            • Part of subcall function 00452B19: SetBkColor.GDI32(?,?), ref: 00452B23
                                                                                            • Part of subcall function 00452B19: ExtTextOutW.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 00452B39
                                                                                          • CreatePen.GDI32(00000000,00000001,?), ref: 00417D21
                                                                                          • ExcludeClipRect.GDI32(?,?,?,?,?,00000000,?,?,00461A78,00000000), ref: 00417DD7
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: IconMenu$ColorRectStateText$ClipCopyCreateDestroyDrawExcludeInfoItemLoad
                                                                                          • String ID: 0$hE
                                                                                          • API String ID: 2801182124-397642793
                                                                                          • Opcode ID: dabd4074ba3d15f08feeb33bbdeb470465c5e95e113bf158c048d6ba16af262e
                                                                                          • Instruction ID: 0152b1cc2ac5a526dcae0ba3b585da3ff5fa043c3d02bc05afe289aaae38b091
                                                                                          • Opcode Fuzzy Hash: dabd4074ba3d15f08feeb33bbdeb470465c5e95e113bf158c048d6ba16af262e
                                                                                          • Instruction Fuzzy Hash: C1B157711083409FC314DF65C885AABBBF8FF99704F04491DF98A83292EB74E949CB66
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 0041466D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004146AA
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004146C5
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00414700
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0041477E
                                                                                          • CreateFontW.GDI32(0000000E,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004147D7
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0041485C
                                                                                            • Part of subcall function 00450DEC: SelectObject.GDI32(?,00000000), ref: 00450E0E
                                                                                            • Part of subcall function 00450DEC: SelectObject.GDI32(?,?), ref: 00450E24
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Create$Compatible$ObjectSelect$BeginBitmapClientFontH_prologPaintRect
                                                                                          • String ID: ,1F$2$Arial$^$hE
                                                                                          • API String ID: 3296668583-579605781
                                                                                          • Opcode ID: 70411a8901b65f33acfc0914e1c5261e9fa95999c507b023ec58c0f82918e53f
                                                                                          • Instruction ID: eb5d6a51e3391f0d52a54f8fcbda3a3b8cb94eed6d9eabcf2d94fbff17ad262c
                                                                                          • Opcode Fuzzy Hash: 70411a8901b65f33acfc0914e1c5261e9fa95999c507b023ec58c0f82918e53f
                                                                                          • Instruction Fuzzy Hash: 04818C75108385AFD314DF65CC85FABBBE8AB84705F004A1EF99583292D778E908CB66
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 00406E6D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00406EAA
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00406EC5
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00406F00
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 00406F7B
                                                                                          • CreateFontW.GDI32(0000000E,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00406FD4
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 00407059
                                                                                            • Part of subcall function 00450DEC: SelectObject.GDI32(?,00000000), ref: 00450E0E
                                                                                            • Part of subcall function 00450DEC: SelectObject.GDI32(?,?), ref: 00450E24
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Create$Compatible$ObjectSelect$BeginBitmapClientFontH_prologPaintRect
                                                                                          • String ID: ,1F$2$Arial$^$hE
                                                                                          • API String ID: 3296668583-579605781
                                                                                          • Opcode ID: 6618668a7a18ddf178a601d66d13e1c342d020fec5972363b1a298fbe8d4b6e8
                                                                                          • Instruction ID: 8ef9b1df1f167e4d44c8462d38fd5cf48b0edd62df3fe08f327eff910c67f875
                                                                                          • Opcode Fuzzy Hash: 6618668a7a18ddf178a601d66d13e1c342d020fec5972363b1a298fbe8d4b6e8
                                                                                          • Instruction Fuzzy Hash: 08819B71108345AFD314DF65CC85FAFBBE8AB84705F004A1EF99593292DB78E908CB66
                                                                                          APIs
                                                                                          • GetCursorPos.USER32(?), ref: 004276A3
                                                                                          • GetWindowRect.USER32(?,?), ref: 004276B5
                                                                                          • CreateFontW.GDI32 ref: 00427708
                                                                                          • CreatePopupMenu.USER32 ref: 0042772E
                                                                                            • Part of subcall function 0044E5BA: lstrlenA.KERNEL32(?,00000000,?,00000000,0043649B,0000001C), ref: 0044E5CF
                                                                                            • Part of subcall function 00417E30: AppendMenuW.USER32(?,00000100,?,?), ref: 00417E99
                                                                                            • Part of subcall function 0044BD57: TrackPopupMenu.USER32(?,?,?,?,00000000,?,?), ref: 0044BD95
                                                                                          • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 004277D7
                                                                                          • RedrawWindow.USER32(?,00000000,00000000,00000105,?,00000000,000000FF,000003EA,iTunes,?,00000000,000000FF,000003E9,Windows Media player,?,00000000), ref: 0042780C
                                                                                            • Part of subcall function 004515A6: DeleteObject.GDI32(00000000), ref: 004515B5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Menu$CreatePopupWindow$AppendCursorDeleteFontMessageObjectPostRectRedrawTracklstrlen
                                                                                          • String ID: ,1F$,1F$Arial$Winamp$Windows Media player$iTunes
                                                                                          • API String ID: 1706510253-132444185
                                                                                          • Opcode ID: 806187c626c4d0fca3ce569c11d56c96cfc117ac369cf423ef418ef8f720c3be
                                                                                          • Instruction ID: bde5ae38c67ec868d9e6d54617e54696a2bf876ddecc82a31dd0129f696732e6
                                                                                          • Opcode Fuzzy Hash: 806187c626c4d0fca3ce569c11d56c96cfc117ac369cf423ef418ef8f720c3be
                                                                                          • Instruction Fuzzy Hash: 1941B670148300BFE314DF65CC46F9B7BE4BB94B54F104A0DF159661D2DBB8A548CB5A
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Prop$Window$ClassLongNameUnicodelstrcmpi
                                                                                          • String ID: edit
                                                                                          • API String ID: 4088303749-2167791130
                                                                                          • Opcode ID: 7356820a773ce204ddae750c45d2619043daa05223cfb2124a55db2ab815b9a3
                                                                                          • Instruction ID: fb9fe95cfd509b0f3cf3f146915c41494c76becb00f62b1af1257e27ec104469
                                                                                          • Opcode Fuzzy Hash: 7356820a773ce204ddae750c45d2619043daa05223cfb2124a55db2ab815b9a3
                                                                                          • Instruction Fuzzy Hash: 7221A86A111612AEB751BB399C00FBB36ECAF59744B000532F915C2156F728CB42CBFE
                                                                                          APIs
                                                                                          • KillTimer.USER32 ref: 0042C45C
                                                                                          • SetTimer.USER32(?,00000064,00000064,00000000), ref: 0042C468
                                                                                          • KillTimer.USER32(?,00000064), ref: 0042C4B3
                                                                                          • GetParent.USER32(?), ref: 0042C4C2
                                                                                          • SendMessageW.USER32(?,-00000114,00000000,?), ref: 0042C4ED
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Timer$Kill$MessageParentSend
                                                                                          • String ID:
                                                                                          • API String ID: 4108980277-0
                                                                                          • Opcode ID: 8d7e52ba8964bb8252397bd3ed654c7abf783a85782ccd4eb6e6c4b6b4daacb2
                                                                                          • Instruction ID: fb4ea1d96d97e762c370f08e4b75e190ec5cb8a93693d667203625a62c862342
                                                                                          • Opcode Fuzzy Hash: 8d7e52ba8964bb8252397bd3ed654c7abf783a85782ccd4eb6e6c4b6b4daacb2
                                                                                          • Instruction Fuzzy Hash: 3751B976340704AFD624DFB6DC84E5BB3A9EB88715F00892AF646C7241E779F809CB64
                                                                                          APIs
                                                                                          • GetWindowTextW.USER32(?,?,00002000), ref: 0041BD4E
                                                                                          • SendMessageW.USER32(?,00000199,?,00000000), ref: 0041BD6E
                                                                                          • SendMessageW.USER32(?,00000182,?,00000000), ref: 0041BD86
                                                                                          • SendMessageW.USER32(?,00000181,?,?), ref: 0041BDB0
                                                                                          • SendMessageW.USER32(?,0000019A,?,00000000), ref: 0041BDC7
                                                                                          • SendMessageW.USER32(?,00000186,?,00000000), ref: 0041BDDD
                                                                                          • DestroyWindow.USER32 ref: 0041BDEC
                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 0041BE0D
                                                                                          • PostMessageW.USER32(?,000005F4,?,?), ref: 0041BE2D
                                                                                          • SendMessageW.USER32(?,00000182,?,00000000), ref: 0041BE4E
                                                                                          • DestroyWindow.USER32 ref: 0041BE61
                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 0041BE82
                                                                                          • CallWindowProcW.USER32(00000000,?,?,?,?), ref: 0041BEA8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message$Send$Window$DestroyInvalidateRect$CallPostProcText
                                                                                          • String ID:
                                                                                          • API String ID: 1774287892-0
                                                                                          • Opcode ID: 4d6223f5744ddbdc007ab63e170e8ca08348df04b9b4e309543a3e0c4ccc704a
                                                                                          • Instruction ID: 750dcf46d0125050d6b32e5045ec8fb20fdcc08bb2088ea6a42b45298a6873ab
                                                                                          • Opcode Fuzzy Hash: 4d6223f5744ddbdc007ab63e170e8ca08348df04b9b4e309543a3e0c4ccc704a
                                                                                          • Instruction Fuzzy Hash: 85513E75240300FFE618DF58EC88E6B33A9FB88720F524A69F6048B2A6D774EC41CB55
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?), ref: 00448434
                                                                                          • GetProcAddress.KERNEL32(00000000,DisableThreadLibraryCalls), ref: 00448440
                                                                                          • EnterCriticalSection.KERNEL32(0049A0A0), ref: 0044845C
                                                                                          • GetVersion.KERNEL32 ref: 0044846E
                                                                                          • GetSystemMetrics.USER32(00000007), ref: 004484B2
                                                                                          • GetSystemMetrics.USER32(00000008), ref: 004484BC
                                                                                          • GetSystemMetrics.USER32(00000004), ref: 004484C6
                                                                                          • GetSystemMetrics.USER32(0000001E), ref: 004484CF
                                                                                          • LeaveCriticalSection.KERNEL32(0049A0A0), ref: 004484DB
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MetricsSystem$CriticalSection$AddressEnterHandleLeaveModuleProcVersion
                                                                                          • String ID: DisableThreadLibraryCalls$KERNEL32.DLL
                                                                                          • API String ID: 1414939872-3863293605
                                                                                          • Opcode ID: de0362f9cc4fe62c44cf172d9748a965913b0276287143c39e3b786e52274621
                                                                                          • Instruction ID: 59be837552266e58ab942db46fc1bed5d084d6fe64a26da124ad8ec1b25d2649
                                                                                          • Opcode Fuzzy Hash: de0362f9cc4fe62c44cf172d9748a965913b0276287143c39e3b786e52274621
                                                                                          • Instruction Fuzzy Hash: B21173708503159BDB10AF71AC0D75E3E64FB14701F50447BF645972A0E77995288F8F
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042B4F1
                                                                                          • SelectObject.GDI32(?,?), ref: 0042B540
                                                                                          • IsRectEmpty.USER32(?), ref: 0042B574
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042B5CA
                                                                                          • SelectObject.GDI32(?,?), ref: 0042B5E4
                                                                                          • StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0042B616
                                                                                          • SelectObject.GDI32(?,?), ref: 0042B64A
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042B6B1
                                                                                          • StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0042B6EA
                                                                                          • SelectObject.GDI32(?,?), ref: 0042B704
                                                                                          • SelectObject.GDI32(?,?), ref: 0042B719
                                                                                          • SelectObject.GDI32(?,00000000), ref: 0042B769
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ObjectSelect$Stretch$BeginCompatibleCreateEmptyH_prologPaintRect
                                                                                          • String ID:
                                                                                          • API String ID: 1523509708-0
                                                                                          • Opcode ID: dfd3bdd3f543f98b2d04b60f0ddc5a3c73a4ad4a8141462d55ea01454a7f0160
                                                                                          • Instruction ID: 491e250323d8dc1721ca4e53233554b82b618ef28d16f4db15b27c605aab1f46
                                                                                          • Opcode Fuzzy Hash: dfd3bdd3f543f98b2d04b60f0ddc5a3c73a4ad4a8141462d55ea01454a7f0160
                                                                                          • Instruction Fuzzy Hash: 94A168B12587159FC314CF25D881F6BB7E9EBC8B14F104A2DF595C3291D738E8088BA6
                                                                                          APIs
                                                                                          • LoadStringW.USER32(10000000,000003F2,?,00000104), ref: 004123E5
                                                                                          • LoadStringW.USER32(10000000,000003ED,?,00000104), ref: 00412414
                                                                                          • LoadStringW.USER32(10000000,000003EE,?,00000104), ref: 00412443
                                                                                          • LoadStringW.USER32(10000000,000003EF,?,00000104), ref: 00412472
                                                                                          • LoadStringW.USER32(10000000,000003F0,?,00000104), ref: 004124A1
                                                                                          • LoadStringW.USER32(10000000,0000044A,?,00000104), ref: 00412589
                                                                                          • RedrawWindow.USER32(?,00000000,00000000,00000105,?,00474614), ref: 004131F0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LoadString$RedrawWindow
                                                                                          • String ID: Alt+$Ctrl+$Win+
                                                                                          • API String ID: 3585389114-1120252461
                                                                                          • Opcode ID: f3e5d04e4d723dc21429c0941f495c3fb5cb17a1edcb6bf434709469b99ccc8c
                                                                                          • Instruction ID: f54b5dd121616077b1f5a696b2e65b495434c43cbea039d69e20d24230345a5a
                                                                                          • Opcode Fuzzy Hash: f3e5d04e4d723dc21429c0941f495c3fb5cb17a1edcb6bf434709469b99ccc8c
                                                                                          • Instruction Fuzzy Hash: 0491A470008346AFE714DF65C895FEE77A8BBD0708F40091EF185531D2EB79A659CB2A
                                                                                          APIs
                                                                                          • LoadStringW.USER32(10000000,000003F2,?,00000104), ref: 00413404
                                                                                          • LoadStringW.USER32(10000000,000003ED,?,00000104), ref: 00413433
                                                                                          • LoadStringW.USER32(10000000,000003EE,?,00000104), ref: 00413462
                                                                                          • LoadStringW.USER32(10000000,000003EF,?,00000104), ref: 00413491
                                                                                          • LoadStringW.USER32(10000000,000003F0,?,00000104), ref: 004134C0
                                                                                          • RedrawWindow.USER32(?,00000000,00000000,00000105,?,00474614), ref: 0041424E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LoadString$RedrawWindow
                                                                                          • String ID: Alt+$Ctrl+$Shift+$Win+
                                                                                          • API String ID: 3585389114-4196241628
                                                                                          • Opcode ID: 4180c3a8aaa211bd8dc8b8c0254000f568ca5ca1395c6a94f3b0c9be8c879256
                                                                                          • Instruction ID: cbd9797f038eb9274bbf44bcd51eb24be050381682bfaab434c690c65fe633b0
                                                                                          • Opcode Fuzzy Hash: 4180c3a8aaa211bd8dc8b8c0254000f568ca5ca1395c6a94f3b0c9be8c879256
                                                                                          • Instruction Fuzzy Hash: 6191B470008345AFE314DF61D895FEA77E8BBD0708F40491EF585432D2EB7AA64ACB26
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 0041A09D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0041A0DA
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0041A0F5
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0041A130
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0041A1AF
                                                                                          • CreateFontW.GDI32(0000000F,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 0041A204
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0041A24F
                                                                                            • Part of subcall function 00450D99: SelectObject.GDI32(?,?), ref: 00450DA1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Create$Compatible$BeginBitmapClientFontH_prologObjectPaintRectSelect
                                                                                          • String ID: ,1F$Arial$hE
                                                                                          • API String ID: 383179049-1295272810
                                                                                          • Opcode ID: c1692bb7cee46ab5018a5091c6f2c03d1242a72245493ef2398a26a4a6ecc49e
                                                                                          • Instruction ID: e313ba107c3752c1707fba32db28cbfbbe95676fdfcdee3892e43da3ef3957c7
                                                                                          • Opcode Fuzzy Hash: c1692bb7cee46ab5018a5091c6f2c03d1242a72245493ef2398a26a4a6ecc49e
                                                                                          • Instruction Fuzzy Hash: 5B718C75108345AFD314EF65CC41FAFB7E8ABC5705F000A1EB99593292DB78E908CB56
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 0041824D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0041828A
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004182A5
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 004182E0
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0041835F
                                                                                          • CreateFontW.GDI32(0000000F,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004183B4
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 004183FF
                                                                                            • Part of subcall function 00450D99: SelectObject.GDI32(?,?), ref: 00450DA1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Create$Compatible$BeginBitmapClientFontH_prologObjectPaintRectSelect
                                                                                          • String ID: ,1F$Arial$hE
                                                                                          • API String ID: 383179049-1295272810
                                                                                          • Opcode ID: 63b773c260e71ef643a571fd036f950cf2238759d78ba00835a5c9c9fb033a7a
                                                                                          • Instruction ID: d16ee2815a3d0a31a8adeb2d3097b3bfbd3e9f97a704156538f0af0a18235282
                                                                                          • Opcode Fuzzy Hash: 63b773c260e71ef643a571fd036f950cf2238759d78ba00835a5c9c9fb033a7a
                                                                                          • Instruction Fuzzy Hash: BF718D75108345AFD314EF65C841FAFB7E8ABC5705F000A1EB99593292DB78E908CB56
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 0042A26D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042A2AA
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042A2C5
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042A300
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042A37F
                                                                                          • CreateFontW.GDI32(0000000F,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 0042A3D4
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042A41F
                                                                                            • Part of subcall function 00450D99: SelectObject.GDI32(?,?), ref: 00450DA1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Create$Compatible$BeginBitmapClientFontH_prologObjectPaintRectSelect
                                                                                          • String ID: ,1F$Arial$hE
                                                                                          • API String ID: 383179049-1295272810
                                                                                          • Opcode ID: 4d5de7bbca52063aa40bc1c43158fd72f7fe567e9a61d8c1893d916637683172
                                                                                          • Instruction ID: 3139df4264f8d4c2948922b03f04425437caaee7b222e57220ec8ec2fc5b4863
                                                                                          • Opcode Fuzzy Hash: 4d5de7bbca52063aa40bc1c43158fd72f7fe567e9a61d8c1893d916637683172
                                                                                          • Instruction Fuzzy Hash: 4A719C75108345AFD314EF65CC45FAFB7E8EB85705F000A1EB98593292DB78E908CB56
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 0042673D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042677A
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00426795
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 004267D0
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042684F
                                                                                          • CreateFontW.GDI32(0000000F,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004268A4
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 004268EF
                                                                                            • Part of subcall function 00450D99: SelectObject.GDI32(?,?), ref: 00450DA1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Create$Compatible$BeginBitmapClientFontH_prologObjectPaintRectSelect
                                                                                          • String ID: ,1F$Arial$hE
                                                                                          • API String ID: 383179049-1295272810
                                                                                          • Opcode ID: b26fc4fe77d2dfd6a9171ba04ea7135d609cb24463b9e97e8d352bdaa75ddd00
                                                                                          • Instruction ID: 42595b0a623d2547920abec18aeab4f2ad40d020b7758430b8783e4a4064bf61
                                                                                          • Opcode Fuzzy Hash: b26fc4fe77d2dfd6a9171ba04ea7135d609cb24463b9e97e8d352bdaa75ddd00
                                                                                          • Instruction Fuzzy Hash: 4F717C75108345AFD314EB65C841FAFBBE8ABC5705F000A1EB99593292DB78E908CB56
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 004051FD
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0040523A
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00405255
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00405290
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0040530F
                                                                                          • CreateFontW.GDI32(0000000F,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00405364
                                                                                          • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 004053AF
                                                                                            • Part of subcall function 00450D99: SelectObject.GDI32(?,?), ref: 00450DA1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Create$Compatible$BeginBitmapClientFontH_prologObjectPaintRectSelect
                                                                                          • String ID: ,1F$Arial$hE
                                                                                          • API String ID: 383179049-1295272810
                                                                                          • Opcode ID: 05256fc1f9fe4126981abc54bda40af311dba9220296713d43480ffedb61d256
                                                                                          • Instruction ID: f8ce66593c26cd44c8162f3ca8ed981511c711cb9ac7ab74c1368dc44bfa741b
                                                                                          • Opcode Fuzzy Hash: 05256fc1f9fe4126981abc54bda40af311dba9220296713d43480ffedb61d256
                                                                                          • Instruction Fuzzy Hash: BD718D75108345AFD314EF65C881FAFB7E8EBC5705F000A2EB99593292DB78E908CB56
                                                                                          APIs
                                                                                          • GetPropA.USER32(?,?), ref: 00447DE4
                                                                                          • CallWindowProcA.USER32(00000000), ref: 00447E09
                                                                                            • Part of subcall function 004451A0: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 004451C6
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451DE
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Prop$CallProcRemoveWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2276450057-0
                                                                                          • Opcode ID: 8b80fb535f366e13326c4d76089314f5863aab57064c52d30af499edd6304e1e
                                                                                          • Instruction ID: 69da421c70c42f0f2f7e11deeaff65480ffaa2f668ecf5c4f6571fe4ae94a145
                                                                                          • Opcode Fuzzy Hash: 8b80fb535f366e13326c4d76089314f5863aab57064c52d30af499edd6304e1e
                                                                                          • Instruction Fuzzy Hash: E951C076A08200BFE214DB45DC84D7BB7B8EBC9755F54466EF94483201E339AC468BA6
                                                                                          APIs
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 0044813E
                                                                                          • GetClientRect.USER32(?,?), ref: 00448159
                                                                                          • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 0044818B
                                                                                          • SelectObject.GDI32(?,00000000), ref: 00448199
                                                                                          • SetBkMode.GDI32(?,00000002), ref: 004481AA
                                                                                          • GetParent.USER32(?), ref: 004481B8
                                                                                          • SendMessageA.USER32(00000000), ref: 004481BF
                                                                                          • SelectObject.GDI32(?,00000000), ref: 004481C9
                                                                                          • SelectObject.GDI32(?,00000000), ref: 004481EB
                                                                                          • SelectObject.GDI32(?,00000000), ref: 004481FB
                                                                                          • OffsetRect.USER32(?,000000FF,000000FF), ref: 00448252
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ObjectSelect$MessageRectSend$ClientLongModeOffsetParentWindow
                                                                                          • String ID:
                                                                                          • API String ID: 3606012576-0
                                                                                          • Opcode ID: 7e6b7687f48163e04729306fd0e80501cc901a02e6b9a6ecb2fc7d727541b6d2
                                                                                          • Instruction ID: dca048fbbab109a79db8bbc650724130f6db9cf844b2b3cbfea5d37236959b7a
                                                                                          • Opcode Fuzzy Hash: 7e6b7687f48163e04729306fd0e80501cc901a02e6b9a6ecb2fc7d727541b6d2
                                                                                          • Instruction Fuzzy Hash: 7D413B722047057BE200AB85AC46F7F73ACFBC5B25F44016EF600961C3DBA8DA05877A
                                                                                          APIs
                                                                                          • GetWindowLongA.USER32(?,000000FC), ref: 004458BD
                                                                                          • RemovePropA.USER32(?,?), ref: 004458F3
                                                                                          • SetWindowLongA.USER32(?,000000FC,00000000), ref: 004458F9
                                                                                          • RemovePropA.USER32(?,?), ref: 00445927
                                                                                          • SetWindowLongA.USER32(?,000000FC,00000000), ref: 0044592D
                                                                                          • GetWindow.USER32(?,00000005), ref: 00445982
                                                                                          • GetWindow.USER32(00000000,00000002), ref: 00445993
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Long$PropRemove
                                                                                          • String ID:
                                                                                          • API String ID: 3256693057-0
                                                                                          • Opcode ID: c84979960d478cc5c27bf1928c859541675ac5311955d39ac28d5ae2b836c213
                                                                                          • Instruction ID: 9c324a7410869733369f485fafa2e376300dcf52e4bdf5eb5358db06236e41c2
                                                                                          • Opcode Fuzzy Hash: c84979960d478cc5c27bf1928c859541675ac5311955d39ac28d5ae2b836c213
                                                                                          • Instruction Fuzzy Hash: AD21F6A6115A15ABEB01AB356C00E7F229CDF9A725B110137F900D2252FB69DD128BBE
                                                                                          APIs
                                                                                          • ShellExecuteW.SHELL32(00000000,open,http://www.aulacn.com,00000000,00000000,00000005), ref: 0040AD23
                                                                                          • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0040B140
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExecuteMessagePostShell
                                                                                          • String ID: !$http://www.aulacn.com$open
                                                                                          • API String ID: 2650313982-2929121675
                                                                                          • Opcode ID: f4ca4be24b7d163bead64ba097c1ff94d43621df4b52945280aa0f11f57556a6
                                                                                          • Instruction ID: f368893a91a8e042a6d193bc98e794a8d6c75e08bf93b6a3aa0761cb6656ee3a
                                                                                          • Opcode Fuzzy Hash: f4ca4be24b7d163bead64ba097c1ff94d43621df4b52945280aa0f11f57556a6
                                                                                          • Instruction Fuzzy Hash: 5202C2303047068BD724DF25C8D0BAA73A6EB80744F10483FE556AB2D1EB79EA15CB5E
                                                                                          APIs
                                                                                          • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 0041CFCB
                                                                                          • SendMessageW.USER32(?,00000197,-00000001,00000000), ref: 0041CFDD
                                                                                          • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 0041CFFA
                                                                                          • SendMessageW.USER32(?,00000197,-00000001,00000000), ref: 0041D00C
                                                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 0041D03E
                                                                                          • SendMessageW.USER32(?,00000182,00000000,00000000), ref: 0041D082
                                                                                          • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 0041D09C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend
                                                                                          • String ID: hE$hE
                                                                                          • API String ID: 3850602802-2849566860
                                                                                          • Opcode ID: 07cac7c4113ce838569cd07417fcd12f19b820d77c94e124eb5fd43a1dbe142d
                                                                                          • Instruction ID: c3cabc4772b956710d99be1ec5b7893d37e73e6c7ddfc020f92f08ac3efb951b
                                                                                          • Opcode Fuzzy Hash: 07cac7c4113ce838569cd07417fcd12f19b820d77c94e124eb5fd43a1dbe142d
                                                                                          • Instruction Fuzzy Hash: 79B182B06047809FD334DB25C891BEBB7E4AF84704F10491EE59A872C1DBB8E985CF5A
                                                                                          APIs
                                                                                            • Part of subcall function 004512A7: __EH_prolog.LIBCMT ref: 004512AC
                                                                                            • Part of subcall function 004512A7: GetDC.USER32(00000001), ref: 004512D5
                                                                                          • GetWindowRect.USER32(?,?), ref: 004229A3
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004229B8
                                                                                          • CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00422A04
                                                                                          • GetPixel.GDI32(?,00000000,00000000), ref: 00422A19
                                                                                          • GetPixel.GDI32(?,00000000,00000000), ref: 00422A56
                                                                                          • CreateRectRgn.GDI32(00000000,00000000,00000001,00000001), ref: 00422A6C
                                                                                          • CombineRgn.GDI32(?,?,?,00000003), ref: 00422A99
                                                                                          • SetWindowRgn.USER32(?,?,00000001), ref: 00422AF4
                                                                                            • Part of subcall function 004515A6: DeleteObject.GDI32(00000000), ref: 004515B5
                                                                                            • Part of subcall function 00450CD6: __EH_prolog.LIBCMT ref: 00450CDB
                                                                                            • Part of subcall function 00450CD6: DeleteDC.GDI32(00000000), ref: 00450CFA
                                                                                            • Part of subcall function 00451319: __EH_prolog.LIBCMT ref: 0045131E
                                                                                            • Part of subcall function 00451319: ReleaseDC.USER32(?,00000000), ref: 0045133D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateH_prologRect$DeletePixelWindow$CombineCompatibleObjectRelease
                                                                                          • String ID: ,&F
                                                                                          • API String ID: 697504870-2457272599
                                                                                          • Opcode ID: 95810ef85a5bf2ac3142e09e5d2e25a6e4a48850342f31752cac84076f167b4c
                                                                                          • Instruction ID: 5063a6a850c70f0611531bc19585ef56a7affe10924b53717529eccf1d72f9a3
                                                                                          • Opcode Fuzzy Hash: 95810ef85a5bf2ac3142e09e5d2e25a6e4a48850342f31752cac84076f167b4c
                                                                                          • Instruction Fuzzy Hash: 79617D75208351AFC304DF65C985E6BBBE9FBD8705F004A1EF88693291DB78E908CB56
                                                                                          APIs
                                                                                          • ReleaseCapture.USER32 ref: 00421E31
                                                                                          • GetClientRect.USER32(?,?), ref: 00421E40
                                                                                            • Part of subcall function 00451199: ClientToScreen.USER32(?,?), ref: 004511AD
                                                                                            • Part of subcall function 00451199: ClientToScreen.USER32(?,?), ref: 004511B6
                                                                                            • Part of subcall function 0045115D: ScreenToClient.USER32(?,00421E62), ref: 00451171
                                                                                            • Part of subcall function 0045115D: ScreenToClient.USER32(?,00421E6A), ref: 0045117A
                                                                                          • wsprintfW.USER32 ref: 00421EB4
                                                                                          • OutputDebugStringW.KERNEL32(?), ref: 00421EC2
                                                                                          • __ftol.LIBCMT ref: 00421EDC
                                                                                          • __ftol.LIBCMT ref: 00421EE7
                                                                                          • PostMessageW.USER32(?,00000446,?,?), ref: 00421F1E
                                                                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?,?,00000001), ref: 00421F79
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Client$Screen$Rect__ftol$CaptureDebugInvalidateMessageOutputPostReleaseStringwsprintf
                                                                                          • String ID: CPHSlider=%f
                                                                                          • API String ID: 3762421152-863250898
                                                                                          • Opcode ID: 3c5f418959843cbe31fbdc7adbefc8c1f3b956125c0faa77df6af46356b90699
                                                                                          • Instruction ID: 905c9cac88fc6b06aba160021f5a54fb972b23072dc12f422c2b19953aaac69e
                                                                                          • Opcode Fuzzy Hash: 3c5f418959843cbe31fbdc7adbefc8c1f3b956125c0faa77df6af46356b90699
                                                                                          • Instruction Fuzzy Hash: 87414971200B019BC724DF3AD885B5BBBEABB88304F448D2DF59AC3255EB34E805CB55
                                                                                          APIs
                                                                                          • GetClassNameW.USER32(?,?,0000000A), ref: 004215A0
                                                                                          • GetPropW.USER32(?,CoolMenu_oldProc), ref: 004215C7
                                                                                          • GetWindowLongW.USER32(?,000000FC), ref: 004215DD
                                                                                          • SetPropW.USER32(?,CoolMenu_oldProc,00000000), ref: 004215EE
                                                                                          • SetWindowLongW.USER32(?,000000FC,00421640), ref: 00421600
                                                                                          • RemovePropW.USER32(?,CoolMenu_oldProc), ref: 00421610
                                                                                          • CallNextHookEx.USER32(00050485,?,?,?), ref: 00421623
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Prop$LongWindow$CallClassHookNameNextRemove
                                                                                          • String ID: #32768$CoolMenu_oldProc
                                                                                          • API String ID: 3867188783-1101824806
                                                                                          • Opcode ID: 94f538e4015b034b7a57f6010c43fa1fd199d8fd7f6e04d4ce2b93c0079179fb
                                                                                          • Instruction ID: 0b584b94a9a8f623d97494505c737e592913e0250f47a16ffd1a4cf4bd97de63
                                                                                          • Opcode Fuzzy Hash: 94f538e4015b034b7a57f6010c43fa1fd199d8fd7f6e04d4ce2b93c0079179fb
                                                                                          • Instruction Fuzzy Hash: 7D1138347043207BC2105F12AC44E5F375CAE66366B94413BF805E33A2E368DA0585EE
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 004320B3
                                                                                          • MapDialogRect.USER32(?,?), ref: 00432139
                                                                                          • SysAllocStringLen.OLEAUT32(?,00000000), ref: 0043215A
                                                                                          • CLSIDFromString.OLE32(0000FFFC,?), ref: 00432245
                                                                                          • CLSIDFromProgID.OLE32(0000FFFC,?), ref: 0043224D
                                                                                          • SetWindowPos.USER32(00000004,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,?,00000000,?,?,?,0000FC84,00000000), ref: 004322E9
                                                                                          • SysFreeString.OLEAUT32(?), ref: 0043233C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: String$From$AllocDialogFreeH_prologProgRectWindow
                                                                                          • String ID: `<u
                                                                                          • API String ID: 493809305-3367579956
                                                                                          • Opcode ID: 4b7ba383f9c0cd9802e1292c17eb351b176914ede04c62376667db35aa5fe550
                                                                                          • Instruction ID: 5edf702b2e4d88c088fb2754b0839bcc5e2885a3b31f3387f76344062e54b9ca
                                                                                          • Opcode Fuzzy Hash: 4b7ba383f9c0cd9802e1292c17eb351b176914ede04c62376667db35aa5fe550
                                                                                          • Instruction Fuzzy Hash: D2A15A7190021ADFDF04DFA9C984AEEB7B4FF08304F14416AE919A7351D7789E50CBA5
                                                                                          APIs
                                                                                          • SendMessageW.USER32(?,00000182,?,00000000), ref: 0041EDE5
                                                                                            • Part of subcall function 0044E5BA: lstrlenA.KERNEL32(?,00000000,?,00000000,0043649B,0000001C), ref: 0044E5CF
                                                                                            • Part of subcall function 00452908: SendMessageW.USER32(?,0000018A,?,00000000), ref: 00452920
                                                                                            • Part of subcall function 00452908: SendMessageW.USER32(?,00000189,?,00000000), ref: 00452939
                                                                                          • SendMessageW.USER32(?,0000018F,000000FF,?), ref: 0041EC56
                                                                                          • SendMessageW.USER32(?,0000018F,00000000,?), ref: 0041ECB6
                                                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 0041ECED
                                                                                          • SendMessageW.USER32(?,00000182,?,00000000), ref: 0041ED27
                                                                                          • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 0041ED39
                                                                                          • SendMessageW.USER32(?,00000185,00000001,?), ref: 0041ED6E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend$lstrlen
                                                                                          • String ID: %d ms
                                                                                          • API String ID: 1172434978-1515537585
                                                                                          • Opcode ID: cf4457ab34c0dd05488bd3bcf071f249076255b1566eabd7ae21a5ed2ead7eec
                                                                                          • Instruction ID: 7a8f34088c7452ec134690093f3d0bad0b4f49c367bd9554e7f7ff306f19462a
                                                                                          • Opcode Fuzzy Hash: cf4457ab34c0dd05488bd3bcf071f249076255b1566eabd7ae21a5ed2ead7eec
                                                                                          • Instruction Fuzzy Hash: 0571A774204741ABD214DB26CC81FAFB3D9BF84708F004A1EF959972C1DB78E945CB6A
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042E0E4
                                                                                          • GetClientRect.USER32(?,?), ref: 0042E0FD
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042E132
                                                                                            • Part of subcall function 00450D99: SelectObject.GDI32(?,?), ref: 00450DA1
                                                                                            • Part of subcall function 00452B19: SetBkColor.GDI32(?,?), ref: 00452B23
                                                                                            • Part of subcall function 00452B19: ExtTextOutW.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 00452B39
                                                                                            • Part of subcall function 00450E61: SetBkMode.GDI32(?,?), ref: 00450E7A
                                                                                            • Part of subcall function 00450E61: SetBkMode.GDI32(?,?), ref: 00450E88
                                                                                            • Part of subcall function 00450E8F: SetTextColor.GDI32(?,?), ref: 00450EA9
                                                                                            • Part of subcall function 00450E8F: SetTextColor.GDI32(?,?), ref: 00450EB7
                                                                                          • CreateFontW.GDI32(0000000C,00000005,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 0042E1BF
                                                                                            • Part of subcall function 00450DEC: SelectObject.GDI32(?,00000000), ref: 00450E0E
                                                                                            • Part of subcall function 00450DEC: SelectObject.GDI32(?,?), ref: 00450E24
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042E237
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ColorCreateObjectSelectText$CompatibleMode$BeginBitmapClientFontH_prologPaintRect
                                                                                          • String ID: ,1F$Arial$hE
                                                                                          • API String ID: 826840735-1295272810
                                                                                          • Opcode ID: 58796e7acd0f9143ddace4b59c9506809e3166461e6937d3dd1ff22dad2c5b28
                                                                                          • Instruction ID: 0458284e29bb08fb97a96ee309a94caf697ecb08c3490af8357fc48d1d707241
                                                                                          • Opcode Fuzzy Hash: 58796e7acd0f9143ddace4b59c9506809e3166461e6937d3dd1ff22dad2c5b28
                                                                                          • Instruction Fuzzy Hash: 88618171108345AFD314DF65C885E6BB7E8FBC5715F000A1DF58693282EB78E908CB66
                                                                                          APIs
                                                                                          • GetStringTypeW.KERNEL32(00000001,00496580,00000001,0043A786,?,?,?,0043A786,?,00000008,00433235,?), ref: 00442B9B
                                                                                          • GetStringTypeA.KERNEL32(00000000,00000001,0046460C,00000001,0043A786,?,?,?,0043A786,?,00000008,00433235,?), ref: 00442BB5
                                                                                          • GetStringTypeW.KERNEL32(?,?,52C,00000008,?,?,?,0043A786,?,00000008,00433235,?), ref: 00442BDC
                                                                                          • WideCharToMultiByte.KERNEL32(?,00000220,?,52C,00000000,00000000,00000000,00000000,?,?,?,0043A786,?,00000008,00433235,?), ref: 00442C0F
                                                                                          • WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,00000000,00000000,00000000,?,?,?,0043A786,?,00000008,00433235,?), ref: 00442C78
                                                                                          • GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,0043A786,?,00000008,00433235,?), ref: 00442CE3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: StringType$ByteCharMultiWide
                                                                                          • String ID: 52C$52C
                                                                                          • API String ID: 3852931651-1048808189
                                                                                          • Opcode ID: 6e227008eda68b2ed163a860bd313c7573348629dacc892a4ec1399db6ccfb09
                                                                                          • Instruction ID: c875d5c873531e6dc896ce1c9b7e3cf3c91a4fa1cadf09af998b5e28fed8fd00
                                                                                          • Opcode Fuzzy Hash: 6e227008eda68b2ed163a860bd313c7573348629dacc892a4ec1399db6ccfb09
                                                                                          • Instruction Fuzzy Hash: 8451DF71900209EFDF218F99DD45EEF7FB8FB49710F20412AF411A22A0D3B89951DBA8
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00436FB1
                                                                                          • VariantClear.OLEAUT32(?), ref: 00437056
                                                                                          • SysFreeString.OLEAUT32(00000000), ref: 004370D7
                                                                                          • SysFreeString.OLEAUT32(00000000), ref: 004370E6
                                                                                          • SysFreeString.OLEAUT32(00000000), ref: 004370F5
                                                                                          • VariantClear.OLEAUT32(?), ref: 004370FF
                                                                                          • VariantClear.OLEAUT32(?), ref: 00437110
                                                                                            • Part of subcall function 004367D5: __EH_prolog.LIBCMT ref: 004367DA
                                                                                            • Part of subcall function 004367D5: VariantClear.OLEAUT32(00000007), ref: 00436D2E
                                                                                            • Part of subcall function 004367D5: VariantClear.OLEAUT32(?), ref: 00436F3B
                                                                                            • Part of subcall function 00438EA8: VariantCopy.OLEAUT32(?,?), ref: 00438EB0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Variant$Clear$FreeString$H_prolog$Copy
                                                                                          • String ID: `<u
                                                                                          • API String ID: 3345578691-3367579956
                                                                                          • Opcode ID: 41362e08d5f148e892ec1b82ee99771624fa0c546cb28e81b40c2c9b39f44017
                                                                                          • Instruction ID: 81ae552e98f6ae3d1397010333435a27fe2d240acbfdd52016cfc75f7c6b7f1d
                                                                                          • Opcode Fuzzy Hash: 41362e08d5f148e892ec1b82ee99771624fa0c546cb28e81b40c2c9b39f44017
                                                                                          • Instruction Fuzzy Hash: DB5128B1904309EFDB24DFA4C889BEEBBB8FF08305F24412AE115A7291D779A945CF54
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00432F29
                                                                                          • GetStockObject.GDI32(00000011), ref: 00432F5C
                                                                                          • GetStockObject.GDI32(0000000D), ref: 00432F67
                                                                                          • GetObjectW.GDI32(?,0000005C,?), ref: 00432F95
                                                                                          • GetDeviceCaps.GDI32(?,0000005A), ref: 00433004
                                                                                          • #253.OLEPRO32(00000020,00464908,?,?), ref: 00433030
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Object$Stock$#253CapsDeviceH_prolog
                                                                                          • String ID: $,1F
                                                                                          • API String ID: 1238440774-1074183395
                                                                                          • Opcode ID: 988dd99c49097f15f020bc28cb6c02b16bdfc5991cf1c52a5310f0b1f15b5ef3
                                                                                          • Instruction ID: dd8fe48067303f66237d17afa86af2c34a1dba55f01f4504cddc6b698c0b4a74
                                                                                          • Opcode Fuzzy Hash: 988dd99c49097f15f020bc28cb6c02b16bdfc5991cf1c52a5310f0b1f15b5ef3
                                                                                          • Instruction Fuzzy Hash: F7415874E0126A9FCB10DFA5C9417EDBBB0BF09305F10406AE504E3291E7B88B49CB59
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: __ftol$ModeRelease
                                                                                          • String ID: W
                                                                                          • API String ID: 1379597261-655174618
                                                                                          • Opcode ID: fae1173272e1d4a1b39f7e351c5731d0394ec43a8b931cdea20011c2e1e76e87
                                                                                          • Instruction ID: 17fed9d173fc3d6e11fc4ad8b7a1412ba0ec4d6ff06955c854cf96f6991a5fa5
                                                                                          • Opcode Fuzzy Hash: fae1173272e1d4a1b39f7e351c5731d0394ec43a8b931cdea20011c2e1e76e87
                                                                                          • Instruction Fuzzy Hash: 60412874A01209EFCB04DF99C589AEEBFB4FF48700F11849AE856AB391D7349A10CF55
                                                                                          APIs
                                                                                          • GetStockObject.GDI32(00000011), ref: 0045012B
                                                                                          • GetStockObject.GDI32(0000000D), ref: 00450133
                                                                                          • GetObjectW.GDI32(00000000,0000005C,?), ref: 00450140
                                                                                          • GetDC.USER32(00000000), ref: 0045014F
                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00450166
                                                                                          • MulDiv.KERNEL32(?,00000048,00000000), ref: 00450172
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0045017D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Object$Stock$CapsDeviceRelease
                                                                                          • String ID: System
                                                                                          • API String ID: 46613423-3470857405
                                                                                          • Opcode ID: 7fa705704d23310be7800419bbd490241f81516f5543a340d31fc2632beb9ff3
                                                                                          • Instruction ID: ccd53f46fa90b999a21785c4df7f836e7aa71df54e63e5452985528334afd2af
                                                                                          • Opcode Fuzzy Hash: 7fa705704d23310be7800419bbd490241f81516f5543a340d31fc2632beb9ff3
                                                                                          • Instruction Fuzzy Hash: 7E117335A00718BFEB149BA1DC49BAE7B68AB04746F004026FA05AB1C1E7B59E0587A9
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,0043C9A9,?,Microsoft Visual C++ Runtime Library,00012010,?,00464454,?,004644A4,?,?,?,Runtime Error!Program: ), ref: 00441A9D
                                                                                          • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00441AB5
                                                                                          • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00441AC6
                                                                                          • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00441AD3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                          • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                                                          • API String ID: 2238633743-4044615076
                                                                                          • Opcode ID: 5ca56c00759f273955e4c99e6149464a0d363e6caf3fd21a810aaf946e917738
                                                                                          • Instruction ID: a989e9165bb769979aaf89243901c31efd435da3118c0234a88239ea83166ead
                                                                                          • Opcode Fuzzy Hash: 5ca56c00759f273955e4c99e6149464a0d363e6caf3fd21a810aaf946e917738
                                                                                          • Instruction Fuzzy Hash: 02017531302351AFDB54DFB95C80A1B7A98E699781314043FB104D3235EE78C8818B69
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,0044D975,?,00020000), ref: 0044D684
                                                                                          • LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 0044D68D
                                                                                          • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0044D6A1
                                                                                          • #17.COMCTL32 ref: 0044D6BC
                                                                                          • #17.COMCTL32 ref: 0044D6D8
                                                                                          • FreeLibrary.KERNEL32(00000000), ref: 0044D6E4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Library$AddressFreeHandleLoadModuleProc
                                                                                          • String ID: COMCTL32.DLL$InitCommonControlsEx
                                                                                          • API String ID: 1437655972-4218389149
                                                                                          • Opcode ID: 393dedfb56f83bc82e090fed47b0f1857773468b89bb0426c7d9c551cd8e3629
                                                                                          • Instruction ID: ab91256f3e2bc1dc39049a623bbe3b6858dea10896f50be0e64778c48e8c4dee
                                                                                          • Opcode Fuzzy Hash: 393dedfb56f83bc82e090fed47b0f1857773468b89bb0426c7d9c551cd8e3629
                                                                                          • Instruction Fuzzy Hash: 6EF0F432A007125BAA115F69ED4890F76ECAB947537060432F908E3211DB68DD018B6E
                                                                                          APIs
                                                                                          • wsprintfW.USER32 ref: 0040901E
                                                                                          • OutputDebugStringW.KERNEL32(?), ref: 0040902E
                                                                                          • UnhookWindowsHookEx.USER32(00000000), ref: 00409036
                                                                                          • wsprintfW.USER32 ref: 00409056
                                                                                          • OutputDebugStringW.KERNEL32(?), ref: 00409060
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DebugOutputStringwsprintf$HookUnhookWindows
                                                                                          • String ID: Hhook: %x$UnHhook: Fail $UnHhook: Success
                                                                                          • API String ID: 3393544223-1816446974
                                                                                          • Opcode ID: f50b1ba98d93ebb344b80e73919ad559971649cc9e424cfab2e52efcabd0cd8e
                                                                                          • Instruction ID: c000ee2fd3b1bf097d6e36f43b0bba590e8d4f7ada7ac3c7ff091d77a3aef5bd
                                                                                          • Opcode Fuzzy Hash: f50b1ba98d93ebb344b80e73919ad559971649cc9e424cfab2e52efcabd0cd8e
                                                                                          • Instruction Fuzzy Hash: 4DF0F6755003017BC210D7ADEC40EE777ACABC8304F45883BB544C3161F678E5048BAA
                                                                                          APIs
                                                                                          • CompareStringW.KERNEL32(00000000,00000000,00496580,00000001,00496580,00000001,00000000,-00000004,?), ref: 00444468
                                                                                          • CompareStringA.KERNEL32(00000000,00000000,0046460C,00000001,0046460C,00000001), ref: 00444485
                                                                                          • CompareStringA.KERNEL32(?,?,00000000,?,?,?,00000000,-00000004,?), ref: 004444E3
                                                                                          • GetCPInfo.KERNEL32(?,00000000,00000000,-00000004,?), ref: 00444534
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000), ref: 004445B3
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,00000000,?,?,?), ref: 00444614
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00444627
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 00444673
                                                                                          • CompareStringW.KERNEL32(?,?,?,?,?,00000000,?,00000000), ref: 0044468B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharCompareMultiStringWide$Info
                                                                                          • String ID:
                                                                                          • API String ID: 1651298574-0
                                                                                          • Opcode ID: 5ee34f588943b4878e36f66e4cbe2313f82ceed054526046215fafedbb5c8ead
                                                                                          • Instruction ID: 1881b4c61fdb1d6308cdfb00f6eaa9eb82b493970b85dc126790abd5b46b45ba
                                                                                          • Opcode Fuzzy Hash: 5ee34f588943b4878e36f66e4cbe2313f82ceed054526046215fafedbb5c8ead
                                                                                          • Instruction Fuzzy Hash: B071AE72900249BFEF218F949C41BAF7FBAEB8A304F14412BF651A6260C7398D51DB59
                                                                                          APIs
                                                                                          • LCMapStringW.KERNEL32(00000000,00000100,00496580,00000001,00000000,00000000,00000100,00000001,?), ref: 004434EA
                                                                                          • LCMapStringA.KERNEL32(00000000,00000100,0046460C,00000001,00000000,00000000), ref: 00443506
                                                                                          • LCMapStringA.KERNEL32(?,?,?,?,?,?,00000100,00000001,?), ref: 0044354F
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000002,?,?,00000000,00000000,00000100,00000001,?), ref: 00443587
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,?,00000000), ref: 004435DF
                                                                                          • LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 004435F5
                                                                                          • LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 00443628
                                                                                          • LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 00443690
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: String$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 352835431-0
                                                                                          • Opcode ID: ddd0a2a3854fef2bcabbe5d1f1feb3f7ba42733b0fdbc271bffd465ef789e45f
                                                                                          • Instruction ID: 8e5533d94e8a2818b565341453466c21037267ca9460028f6b3140095a4e4b19
                                                                                          • Opcode Fuzzy Hash: ddd0a2a3854fef2bcabbe5d1f1feb3f7ba42733b0fdbc271bffd465ef789e45f
                                                                                          • Instruction Fuzzy Hash: 64518D3190024ABFEF318F55CC45AAF7FB9FB49B52F10012AF914A1260D7398E11DBA9
                                                                                          APIs
                                                                                          • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,00439131), ref: 0043C2B3
                                                                                          • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,00439131), ref: 0043C2C7
                                                                                          • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,00439131), ref: 0043C2E8
                                                                                          • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0043C31F
                                                                                          • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,00439131), ref: 0043C33F
                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00000000,?,00000000,?,?,?,00439131), ref: 0043C35D
                                                                                          • FreeEnvironmentStringsA.KERNEL32(00000000,?,00000000,?,?,?,00439131), ref: 0043C392
                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00439131,?,00000000,?,?,?,00439131), ref: 0043C3C2
                                                                                          • FreeEnvironmentStringsA.KERNEL32(00000000,?,00000000,?,?,?,00439131), ref: 0043C3F8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 158306478-0
                                                                                          • Opcode ID: f1d8a0968d930bf52bfe774ee214141a8baa4a77df991cbc6e270f04723240ee
                                                                                          • Instruction ID: ba6c970b01b3f20653a5985f293943ca0a4225f3dba61a6a28aaa31425b8f568
                                                                                          • Opcode Fuzzy Hash: f1d8a0968d930bf52bfe774ee214141a8baa4a77df991cbc6e270f04723240ee
                                                                                          • Instruction Fuzzy Hash: 594123329043159BD7316B799C8472B7798EB4A324F25652FFC02F2290DAA8CC00839D
                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004467C7
                                                                                          • EnterCriticalSection.KERNEL32(0049A0A0), ref: 004467D4
                                                                                          • LeaveCriticalSection.KERNEL32(0049A0A0), ref: 0044681C
                                                                                          • CallNextHookEx.USER32(00000000,?,?,?), ref: 00446833
                                                                                          • LeaveCriticalSection.KERNEL32(0049A0A0), ref: 0044684E
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 00446892
                                                                                          • SendMessageA.USER32(?,000011F0,00000000,00000001), ref: 004468B9
                                                                                          • GetParent.USER32(?), ref: 00446921
                                                                                          • CallNextHookEx.USER32(?,?,?,?), ref: 0044695E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$CallHookLeaveNext$CurrentEnterLongMessageParentSendThreadWindow
                                                                                          • String ID:
                                                                                          • API String ID: 1151315845-0
                                                                                          • Opcode ID: b29041a4716bbb060f72af5d7c1b3e5c1ddd68a8061c8d950c322470bf6737a9
                                                                                          • Instruction ID: a3ea0335036cab777ab13f888ca24934f32f7369a31d6d88b032d86742650d60
                                                                                          • Opcode Fuzzy Hash: b29041a4716bbb060f72af5d7c1b3e5c1ddd68a8061c8d950c322470bf6737a9
                                                                                          • Instruction Fuzzy Hash: 0141CBB15043009BEB00EF10EC4AB6B73A8AB46319F11413BFD4583252D778E918CBAF
                                                                                          APIs
                                                                                          • GetActiveWindow.USER32 ref: 00403752
                                                                                          • GetParent.USER32(00000000), ref: 0040376B
                                                                                          • GetCapture.USER32 ref: 00403779
                                                                                          • SetCapture.USER32(00000000), ref: 004037A5
                                                                                          • InvalidateRect.USER32(00000000,00000000,00000001,00000000), ref: 004037B9
                                                                                          • ClientToScreen.USER32(00000000,?), ref: 004037E2
                                                                                          • WindowFromPoint.USER32(?,?), ref: 004037F2
                                                                                          • ReleaseCapture.USER32 ref: 00403834
                                                                                            • Part of subcall function 00403C60: GetParent.USER32(?), ref: 00403C69
                                                                                            • Part of subcall function 00403C60: PostMessageW.USER32(?,00000464,?,?), ref: 00403C8D
                                                                                            • Part of subcall function 00403C60: PostMessageW.USER32(000104EA,00000465,?,00000000), ref: 00403CAB
                                                                                          • InvalidateRect.USER32(00000000,00000000,00000001,00000000), ref: 0040382A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Capture$InvalidateMessageParentPostRectWindow$ActiveClientFromPointReleaseScreen
                                                                                          • String ID:
                                                                                          • API String ID: 1133298849-0
                                                                                          • Opcode ID: f75c0d0c00882e264f01bde6f659ec9ff75440374c3ab34f20333f9e22c1ed3c
                                                                                          • Instruction ID: c5939422b409be9f49ea0809be108f4817c2939417782be2b334de77af7bc82a
                                                                                          • Opcode Fuzzy Hash: f75c0d0c00882e264f01bde6f659ec9ff75440374c3ab34f20333f9e22c1ed3c
                                                                                          • Instruction Fuzzy Hash: 5E3194B12107049FD724AFA6D888A1B77E8EF4470AF00492EFA41D7381E779E904CB65
                                                                                          APIs
                                                                                          • GetActiveWindow.USER32 ref: 00403E55
                                                                                          • GetParent.USER32(00000000), ref: 00403E6E
                                                                                          • GetCapture.USER32 ref: 00403E7C
                                                                                          • SetCapture.USER32(00000000), ref: 00403EAB
                                                                                          • InvalidateRect.USER32(00000000,00000000,00000001,00000000), ref: 00403EBF
                                                                                          • ClientToScreen.USER32(00000000,?), ref: 00403EE8
                                                                                          • WindowFromPoint.USER32(?,?), ref: 00403EF8
                                                                                          • ReleaseCapture.USER32 ref: 00403F40
                                                                                            • Part of subcall function 00404010: GetParent.USER32(?), ref: 00404017
                                                                                            • Part of subcall function 00404010: PostMessageW.USER32(?,00000464,?,?), ref: 00404038
                                                                                          • InvalidateRect.USER32(00000000,00000000,00000001,00000000), ref: 00403F36
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Capture$InvalidateParentRectWindow$ActiveClientFromMessagePointPostReleaseScreen
                                                                                          • String ID:
                                                                                          • API String ID: 66965210-0
                                                                                          • Opcode ID: 2aa5d2489e055216030fc9f554a8054c7d0bbb34706ea6ca49d5153ed9136eff
                                                                                          • Instruction ID: b9b7ae9452be1cb92fdc9eeb82be43e356ff0b28585e416e8e3b1393e3e8d8bc
                                                                                          • Opcode Fuzzy Hash: 2aa5d2489e055216030fc9f554a8054c7d0bbb34706ea6ca49d5153ed9136eff
                                                                                          • Instruction Fuzzy Hash: 3731A4712007049FD724EFA2DC49B5B77A8EF84B06F00492EF945D7281EB79E905CBA5
                                                                                          APIs
                                                                                          • lstrlenW.KERNEL32(?,?,?,?,?,?,0040E5E0), ref: 00448E9B
                                                                                          • GetFocus.USER32 ref: 00448EC3
                                                                                            • Part of subcall function 0044B7AD: UnhookWindowsHookEx.USER32(?), ref: 0044B7D2
                                                                                          • IsWindowEnabled.USER32(?), ref: 00448EEC
                                                                                          • EnableWindow.USER32(?,00000000), ref: 00448EFE
                                                                                          • GetOpenFileNameW.COMDLG32(?,?,?), ref: 00448F29
                                                                                          • GetSaveFileNameW.COMDLG32(?,?,?), ref: 00448F30
                                                                                          • EnableWindow.USER32(?,00000001), ref: 00448F47
                                                                                          • IsWindow.USER32(?), ref: 00448F4D
                                                                                          • SetFocus.USER32(?), ref: 00448F5B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$EnableFileFocusName$EnabledHookOpenSaveUnhookWindowslstrlen
                                                                                          • String ID:
                                                                                          • API String ID: 3606897497-0
                                                                                          • Opcode ID: 649189518c82b2c8d545e37e5d2d8cecb0cac5807c2707febdd8394477a59e6e
                                                                                          • Instruction ID: 27ee3407ccd4bf0f44c0104ec26ea91c1217e90a6af80676a504ee7cda63583d
                                                                                          • Opcode Fuzzy Hash: 649189518c82b2c8d545e37e5d2d8cecb0cac5807c2707febdd8394477a59e6e
                                                                                          • Instruction Fuzzy Hash: 9E21B1712147009BE725AB32DC46B5F77E9EF84305F10442FF55296292DF79E8048B5A
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(0049A0A0,?,0044563F), ref: 004461E6
                                                                                          • GlobalDeleteAtom.KERNEL32(?), ref: 00446222
                                                                                          • GlobalDeleteAtom.KERNEL32(?), ref: 0044623D
                                                                                          • GlobalDeleteAtom.KERNEL32(?), ref: 00446250
                                                                                          • GlobalDeleteAtom.KERNEL32(?), ref: 00446263
                                                                                          • GlobalDeleteAtom.KERNEL32(?), ref: 00446276
                                                                                          • GlobalDeleteAtom.KERNEL32(?), ref: 00446289
                                                                                          • GlobalDeleteAtom.KERNEL32(?), ref: 0044629C
                                                                                          • LeaveCriticalSection.KERNEL32(0049A0A0,?,0044563F), ref: 004462AD
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: AtomDeleteGlobal$CriticalSection$EnterLeave
                                                                                          • String ID:
                                                                                          • API String ID: 3843206905-0
                                                                                          • Opcode ID: 64d719efbc967f1ada05464b222b443c3bf0e0f3c2da27167636090d26cdd518
                                                                                          • Instruction ID: d45f3717093810a23755f18aa1389c2ba90ff6b1d816d78afea173f0f7864427
                                                                                          • Opcode Fuzzy Hash: 64d719efbc967f1ada05464b222b443c3bf0e0f3c2da27167636090d26cdd518
                                                                                          • Instruction Fuzzy Hash: CB11256A801304A2EB153FA4EC087A63AB8B729304F0544B7E404436B1D7BC48E6CBEF
                                                                                          APIs
                                                                                          • LoadStringW.USER32(10000000,000003F2,?,00000104), ref: 00406717
                                                                                          • RedrawWindow.USER32(00000000,00000000,00000000,00000105,?,00000000,00474614), ref: 00406CD5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LoadRedrawStringWindow
                                                                                          • String ID: %s%s$Alt+$Ctrl+$Shift+$Win+
                                                                                          • API String ID: 1390970911-4223590347
                                                                                          • Opcode ID: c4d00b90bb3b75847841bc569747d2ea8310110c5b9f83381d49a45698b45adf
                                                                                          • Instruction ID: 5910786826005e199431ce93b14a392e584c54fc97b16f28aa2e55f40363f721
                                                                                          • Opcode Fuzzy Hash: c4d00b90bb3b75847841bc569747d2ea8310110c5b9f83381d49a45698b45adf
                                                                                          • Instruction Fuzzy Hash: 04D183B1148341AEF310DB51C881FABB7A8FBD4B08F40491EF6C6161C1DBBA9659C76B
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004169E1
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00416A14
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00416A50
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00416AB4
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00416AFA
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00416B2F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CompatibleCreate$BeginBitmapH_prologPaint
                                                                                          • String ID: hE
                                                                                          • API String ID: 1771348543-2023966264
                                                                                          • Opcode ID: 2d02f0ccce2085d7f3b3ea297feb576969427059efabbdf1b135547709f18a2f
                                                                                          • Instruction ID: 047177d8f0f599437b8f077ce8f0f693da4a7a8b73c77a4477af4e952b84b6e7
                                                                                          • Opcode Fuzzy Hash: 2d02f0ccce2085d7f3b3ea297feb576969427059efabbdf1b135547709f18a2f
                                                                                          • Instruction Fuzzy Hash: B3716E75204345AFD324DF79CC81F6BB7E9AB89704F044E1DB98683292DA78F909CB51
                                                                                          APIs
                                                                                            • Part of subcall function 00448D2A: __EH_prolog.LIBCMT ref: 00448D2F
                                                                                            • Part of subcall function 00448D2A: lstrcpynW.KERNEL32(?,?,00000104,00000206,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,?,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 00448E1E
                                                                                            • Part of subcall function 00448E91: lstrlenW.KERNEL32(?,?,?,?,?,?,0040E5E0), ref: 00448E9B
                                                                                            • Part of subcall function 00448E91: GetFocus.USER32 ref: 00448EC3
                                                                                            • Part of subcall function 00448E91: IsWindowEnabled.USER32(?), ref: 00448EEC
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000000), ref: 00448EFE
                                                                                            • Part of subcall function 00448E91: GetOpenFileNameW.COMDLG32(?,?,?), ref: 00448F29
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000001), ref: 00448F47
                                                                                            • Part of subcall function 00448E91: IsWindow.USER32(?), ref: 00448F4D
                                                                                            • Part of subcall function 00448E91: SetFocus.USER32(?), ref: 00448F5B
                                                                                            • Part of subcall function 00448F79: __EH_prolog.LIBCMT ref: 00448F7E
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 00448FBB
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000464,00000104,00000000), ref: 00448FE3
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 0044900C
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000465,00000104,00000000), ref: 00449029
                                                                                            • Part of subcall function 00449145: __EH_prolog.LIBCMT ref: 0044914A
                                                                                          • DeleteFileW.KERNEL32(00000000,?,00000000), ref: 00420D51
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$H_prolog$EnableFileFocusMessageParentSend$DeleteEnabledNameOpenlstrcpynlstrlen
                                                                                          • String ID: %sconfig\.macro$*.macro$C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\$Macro(*.macro)|*.macro|$Macros$X
                                                                                          • API String ID: 659272761-1178881100
                                                                                          • Opcode ID: b985f69bae04cceae624def5850ea3d6cf247c3a8b9b0e74f13156b434899cec
                                                                                          • Instruction ID: 30c78ed7480d8e792ca16ede5287972ed89a11bd148789249e366cd0fda4aaa0
                                                                                          • Opcode Fuzzy Hash: b985f69bae04cceae624def5850ea3d6cf247c3a8b9b0e74f13156b434899cec
                                                                                          • Instruction Fuzzy Hash: 70516F7014C3809BE325EB65C556B9EBBD8BB94B08F54490EF48D42282DF786648CB67
                                                                                          APIs
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 0043C8F2
                                                                                          • GetStdHandle.KERNEL32(000000F4,00464454,00000000,?,00000000,?), ref: 0043C9C8
                                                                                          • WriteFile.KERNEL32(00000000), ref: 0043C9CF
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$HandleModuleNameWrite
                                                                                          • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                          • API String ID: 3784150691-4022980321
                                                                                          • Opcode ID: bb41203e31a96f049edc4bcc6cb2c44c3c06d17c1fc860f20d82116807f1b503
                                                                                          • Instruction ID: d4f7577b594f28065bb4c647d68ecba6432c9f637e0336fdd4f19ed6344c0c60
                                                                                          • Opcode Fuzzy Hash: bb41203e31a96f049edc4bcc6cb2c44c3c06d17c1fc860f20d82116807f1b503
                                                                                          • Instruction Fuzzy Hash: 5631EBB26402186FEF24EA61CC86FDA736CEF45355F10046BF544F6191EA78EA808B5E
                                                                                          APIs
                                                                                          • PtInRect.USER32(?,?,?), ref: 00415605
                                                                                          • wsprintfW.USER32 ref: 0041562B
                                                                                          • PostMessageW.USER32(?,0000046C,00000000,?), ref: 00415649
                                                                                          • PostMessageW.USER32(?,0000046C,00000001,00000000), ref: 0041568C
                                                                                          • wsprintfW.USER32 ref: 004156A0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessagePostwsprintf$Rect
                                                                                          • String ID: Hide m_iOverColor:=%d $m_iOverColor:=%d
                                                                                          • API String ID: 3121059675-1228356213
                                                                                          • Opcode ID: 3261bbef1be082c1ecaf9b1d66cd420b4524b55bf3ea72dfaf3c7adfaee1a57e
                                                                                          • Instruction ID: 76131e3d91bbfd372a4224498d038619d2d5f3be3fb38c3be7dd262d6c3f6a8d
                                                                                          • Opcode Fuzzy Hash: 3261bbef1be082c1ecaf9b1d66cd420b4524b55bf3ea72dfaf3c7adfaee1a57e
                                                                                          • Instruction Fuzzy Hash: 2B21DB31200300EBD714AF59ECC4EAB7B29EB84725F10467FFD058B296E675D909CBA9
                                                                                          APIs
                                                                                          • GetMonitorInfoW.USER32(?,?), ref: 004319C3
                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004319EA
                                                                                          • GetSystemMetrics.USER32(00000000), ref: 00431A02
                                                                                          • GetSystemMetrics.USER32(00000001), ref: 00431A09
                                                                                          • lstrcpyW.KERNEL32(?,DISPLAY), ref: 00431A2D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: System$InfoMetrics$MonitorParameterslstrcpy
                                                                                          • String ID: B$DISPLAY
                                                                                          • API String ID: 1771318095-3316187204
                                                                                          • Opcode ID: e9e3ddd51f73c0dec775de94295c0daa4b40e9388bdaac627a078832ca99a64b
                                                                                          • Instruction ID: 81c416b3690528379a51d72f0c313b73b94be9532d3ac44b80f8aa6590f69880
                                                                                          • Opcode Fuzzy Hash: e9e3ddd51f73c0dec775de94295c0daa4b40e9388bdaac627a078832ca99a64b
                                                                                          • Instruction Fuzzy Hash: F911A371502324ABCF15AFA59C84A9BBFA8EF0E752F044867FC049A126D3B5D540CBA9
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00433E3C
                                                                                            • Part of subcall function 00433C09: CoGetClassObject.OLE32(00000000,?,00000000,00464A38,00000003,?,?,?,?,00433E65,?,00000000,00000003,00464A08,?,?), ref: 00433C29
                                                                                            • Part of subcall function 004517A2: __EH_prolog.LIBCMT ref: 004517A7
                                                                                            • Part of subcall function 0045187E: __EH_prolog.LIBCMT ref: 00451883
                                                                                          • CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 00433FC2
                                                                                          • StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 00433FE3
                                                                                          • GlobalAlloc.KERNEL32(00000000,00000000), ref: 0043402B
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00434039
                                                                                          • GlobalUnlock.KERNEL32(?), ref: 00434051
                                                                                          • CreateILockBytesOnHGlobal.OLE32(?,00000001,?), ref: 00434074
                                                                                          • StgOpenStorageOnILockBytes.OLE32(?,00000000,00000012,00000000,00000000,00000000), ref: 00434090
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: GlobalLock$Bytes$CreateH_prolog$AllocClassDocfileObjectOpenStorageUnlock
                                                                                          • String ID:
                                                                                          • API String ID: 645133905-0
                                                                                          • Opcode ID: b3edf9308cc4d60c95a5bb60e7fec893c344d0ba26c85d4dd2f6f134daee127f
                                                                                          • Instruction ID: c7f02825a4df392e077f54da2a993fb5331d6a7dbec5edc7e76ae168c25567a4
                                                                                          • Opcode Fuzzy Hash: b3edf9308cc4d60c95a5bb60e7fec893c344d0ba26c85d4dd2f6f134daee127f
                                                                                          • Instruction Fuzzy Hash: 0DB127B0A0020AAFCB14DF54C888AAE7BB9FF48305F50446EF916DB250C775ED45CB65
                                                                                          APIs
                                                                                          • LCMapStringW.KERNEL32(00000000,00000100,00496580,00000001,00000000,00000000,?,?,00499F60), ref: 0043FA31
                                                                                          • LCMapStringA.KERNEL32(00000000,00000100,0046460C,00000001,00000000,00000000), ref: 0043FA4D
                                                                                          • LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,00499F60), ref: 0043FA96
                                                                                          • WideCharToMultiByte.KERNEL32(00499F60,00000220,?,?,00000000,00000000,00000000,00000000,?,?,00499F60), ref: 0043FAC9
                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000220,?,?,?,00000000,00000000,00000000), ref: 0043FB20
                                                                                          • LCMapStringA.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 0043FB3C
                                                                                          • LCMapStringA.KERNEL32(?,?,?,00000000,?,00000000), ref: 0043FB92
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: String$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 352835431-0
                                                                                          • Opcode ID: 0251d1db1be118e5d411a3d6232b3e44e508657085ecdb7e4f467c0321fa0c00
                                                                                          • Instruction ID: a9f6bfd5a9a451199434dc59b0964cf45681f525746ffd7b143027d92a3ce8ce
                                                                                          • Opcode Fuzzy Hash: 0251d1db1be118e5d411a3d6232b3e44e508657085ecdb7e4f467c0321fa0c00
                                                                                          • Instruction Fuzzy Hash: 345189B1900219EFDF228F95DC45EAFBF79FB09794F10002BF504A5260C3399965DBA9
                                                                                          APIs
                                                                                          • ReleaseCapture.USER32 ref: 0042C2A8
                                                                                          • GetParent.USER32(?), ref: 0042C2C9
                                                                                          • SendMessageW.USER32(?,-00000114,?,?), ref: 0042C300
                                                                                          • GetDC.USER32(?), ref: 0042C30A
                                                                                          • OffsetRect.USER32(00000000,?,00000000), ref: 0042C362
                                                                                          • ReleaseDC.USER32(?,?), ref: 0042C3B2
                                                                                          • KillTimer.USER32(?,00000064), ref: 0042C3DC
                                                                                          • KillTimer.USER32(?,000000C8), ref: 0042C3F3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: KillReleaseTimer$CaptureMessageOffsetParentRectSend
                                                                                          • String ID:
                                                                                          • API String ID: 2486821647-0
                                                                                          • Opcode ID: c57c270cfe4095e56ba0613b52b0407f82fb27206fde1a4635fe2da8542a022c
                                                                                          • Instruction ID: 96d2222e6f25a5eb1a89357426a936bb4924c6c40993326f6eb660849417993b
                                                                                          • Opcode Fuzzy Hash: c57c270cfe4095e56ba0613b52b0407f82fb27206fde1a4635fe2da8542a022c
                                                                                          • Instruction Fuzzy Hash: 54416C71600710AFD324DF69D884A6BB7E9EB88715F008A1EF59AC7341E734E905CBA5
                                                                                          APIs
                                                                                          • GlobalLock.KERNEL32(?), ref: 0044EC2D
                                                                                          • lstrcmpW.KERNEL32(00000000,?), ref: 0044EC3A
                                                                                          • OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 0044EC4C
                                                                                          • DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0044EC6F
                                                                                          • GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0044EC77
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0044EC84
                                                                                          • DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 0044EC91
                                                                                          • ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 0044ECAF
                                                                                            • Part of subcall function 00451DAA: GlobalFlags.KERNEL32(?), ref: 00451DB4
                                                                                            • Part of subcall function 00451DAA: GlobalUnlock.KERNEL32(?), ref: 00451DCB
                                                                                            • Part of subcall function 00451DAA: GlobalFree.KERNEL32(?), ref: 00451DD6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
                                                                                          • String ID:
                                                                                          • API String ID: 168474834-0
                                                                                          • Opcode ID: bf5832417dd79c890477d62380f94c36e75e17012e941b875a2572de2a9e49f9
                                                                                          • Instruction ID: cba2de980fc952aae4cbd78a4ade82b36b9988dda6f229a0acbdc05e828fdb5a
                                                                                          • Opcode Fuzzy Hash: bf5832417dd79c890477d62380f94c36e75e17012e941b875a2572de2a9e49f9
                                                                                          • Instruction Fuzzy Hash: 5A118F71500204BEEB21AFA7DC8AEAF7ABEFBC5705F10045AF609C2122D639DD00D764
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00455739
                                                                                          • lstrlenA.KERNEL32(?,?,00000000), ref: 00455764
                                                                                            • Part of subcall function 0045551D: VariantChangeType.OLEAUT32(?,?,00000000), ref: 004555BF
                                                                                          • VariantClear.OLEAUT32(0000000C), ref: 00455898
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Variant$ChangeClearH_prologTypelstrlen
                                                                                          • String ID: `<u
                                                                                          • API String ID: 1986235341-3367579956
                                                                                          • Opcode ID: 979e8ea9fd0e5e4b1b3ee1af8146f385942817e68ea8c17448994f936bdea4da
                                                                                          • Instruction ID: 2a865446cec1a54c68e977b13060fdeae629f57a151f6f093edcc904361f42ad
                                                                                          • Opcode Fuzzy Hash: 979e8ea9fd0e5e4b1b3ee1af8146f385942817e68ea8c17448994f936bdea4da
                                                                                          • Instruction Fuzzy Hash: D071AF7181060AEBCB10DFA5C8919BEBBB4FF05361F14801BFC059B262D738D959CB99
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00422798
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004227CE
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 004227FB
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042284F
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042287A
                                                                                            • Part of subcall function 00450CD6: __EH_prolog.LIBCMT ref: 00450CDB
                                                                                            • Part of subcall function 00450CD6: DeleteDC.GDI32(00000000), ref: 00450CFA
                                                                                            • Part of subcall function 00451481: __EH_prolog.LIBCMT ref: 00451486
                                                                                            • Part of subcall function 00451481: EndPaint.USER32(?,?,00000000,?,00401171,?,00000000), ref: 004514A3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CompatibleCreateH_prolog$Paint$BeginBitmapDelete
                                                                                          • String ID: hE
                                                                                          • API String ID: 925132120-2023966264
                                                                                          • Opcode ID: 298895ce4cfbc1522309eb09b02266c498cf8ce30f5981f3909c97d5c28bfdb9
                                                                                          • Instruction ID: 947a62e68fedfbb367bd283132d4cbbc4228837792040f1b20f6862c35582b5b
                                                                                          • Opcode Fuzzy Hash: 298895ce4cfbc1522309eb09b02266c498cf8ce30f5981f3909c97d5c28bfdb9
                                                                                          • Instruction Fuzzy Hash: EA51AE75108345AFD314EB65CC82F6BB7E8ABC4315F044E1EB99583282DB78E90DCB26
                                                                                          APIs
                                                                                          • GetDC.USER32(?), ref: 0042C65C
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0042C68B
                                                                                          • SelectObject.GDI32(?,?), ref: 0042C6AE
                                                                                          • BitBlt.GDI32(?,00000000,?,?,?,?,00000000,00000000,00CC0020), ref: 0042C744
                                                                                          • StretchBlt.GDI32(?,00000000,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0042C775
                                                                                          • ReleaseDC.USER32(?,?), ref: 0042C787
                                                                                          • SelectObject.GDI32(?,?), ref: 0042C7A1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ObjectSelect$CompatibleCreateReleaseStretch
                                                                                          • String ID:
                                                                                          • API String ID: 566524821-0
                                                                                          • Opcode ID: 377b5bb33147296ae9096624321a997b7e926c496ab1782326aa9955a7ea21a7
                                                                                          • Instruction ID: 421bf36d172bdea43dc1709f528203259536442395a9df4c2bbaf0337f0f557d
                                                                                          • Opcode Fuzzy Hash: 377b5bb33147296ae9096624321a997b7e926c496ab1782326aa9955a7ea21a7
                                                                                          • Instruction Fuzzy Hash: 945137B6204706AFC304CF69C884E2BBBE9EBC8714F148A1DF55683391D734E80ACB65
                                                                                          APIs
                                                                                          • GetPropA.USER32(?,?), ref: 00448313
                                                                                          • CallWindowProcA.USER32(00000000), ref: 00448335
                                                                                            • Part of subcall function 004451A0: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 004451C6
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451DE
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Prop$CallProcRemoveWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2276450057-0
                                                                                          • Opcode ID: 573124bf544e5dbb1ed33cacf49311064371592b6b8819feffabab557f233c2e
                                                                                          • Instruction ID: c60c49c105b61ddcd17f307b40f0de3b88e7ecc4f00596540e21f1d5958c2384
                                                                                          • Opcode Fuzzy Hash: 573124bf544e5dbb1ed33cacf49311064371592b6b8819feffabab557f233c2e
                                                                                          • Instruction Fuzzy Hash: 8031D6766002106FE2119B99AC45D9F779CDFD6366F04042AFD05C7202E779A90686BB
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32(?,?), ref: 00402A35
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00402A6E
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00402A9E
                                                                                            • Part of subcall function 00450D99: SelectObject.GDI32(?,?), ref: 00450DA1
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00402B0F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CompatibleCreate$BeginBitmapClientH_prologObjectPaintRectSelect
                                                                                          • String ID: hE$hE
                                                                                          • API String ID: 2935244108-2849566860
                                                                                          • Opcode ID: 436639cc240e3800f635718f011afd656e72a5db5a4997a65bb998cc291b242e
                                                                                          • Instruction ID: b6017205da7f6528a54e54b710c70e8e77c3024c50f60c64120ec1e282dcdb57
                                                                                          • Opcode Fuzzy Hash: 436639cc240e3800f635718f011afd656e72a5db5a4997a65bb998cc291b242e
                                                                                          • Instruction Fuzzy Hash: 5541BF75208341AFD314DF25C845F6BBBE8BBC8704F108A1DF49993291DB78E909CB66
                                                                                          APIs
                                                                                          • SetBkColor.GDI32(?), ref: 0044529D
                                                                                          • ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 004452EA
                                                                                          • ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 00445319
                                                                                          • SetBkColor.GDI32(?,?), ref: 00445337
                                                                                          • ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 00445362
                                                                                          • ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044539C
                                                                                          • SetBkColor.GDI32(?,00000000), ref: 004453A4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Text$Color
                                                                                          • String ID:
                                                                                          • API String ID: 3751486306-0
                                                                                          • Opcode ID: 3323395db516032c6e1b36f8c1412d4d9c1ef1067fedb981304292be48cd2291
                                                                                          • Instruction ID: d662fd4a1b48ec9f8d784f711c7aa166ee1dc07e0dc8a78a06d380309897b4c2
                                                                                          • Opcode Fuzzy Hash: 3323395db516032c6e1b36f8c1412d4d9c1ef1067fedb981304292be48cd2291
                                                                                          • Instruction Fuzzy Hash: 0B418F70244305AFE720DF14DC86F2AB7E4FB84B40F14485DFA54AA2C1D7B5E909CB6A
                                                                                          APIs
                                                                                          • SendMessageW.USER32 ref: 0041FB67
                                                                                            • Part of subcall function 0044A9E5: __EH_prolog.LIBCMT ref: 0044A9EA
                                                                                            • Part of subcall function 0044A9E5: FindResourceW.KERNEL32(?,00000000,00000005,00000000,?,00000000), ref: 0044AA22
                                                                                            • Part of subcall function 0044A9E5: LoadResource.KERNEL32(?,00000000,?,00000000), ref: 0044AA2A
                                                                                            • Part of subcall function 0044A9E5: LockResource.KERNEL32(?,00000000,?,00000000), ref: 0044AA37
                                                                                            • Part of subcall function 004515A6: DeleteObject.GDI32(00000000), ref: 004515B5
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                            • Part of subcall function 0044A6B8: __EH_prolog.LIBCMT ref: 0044A6BD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$H_prolog$DecrementDeleteFindInterlockedLoadLockMessageObjectSend
                                                                                          • String ID: Delete$Edit$Insert delay$Record after$Record before
                                                                                          • API String ID: 297870441-1752351586
                                                                                          • Opcode ID: 306ed4eafdf362f1a9668c7a7413176227ade94c4a4f11e8963c75f4ae46f6e1
                                                                                          • Instruction ID: 57f25d6645f84f0c38c412f0d28e895c1ec565e0525da07fe82a0b202ad410a2
                                                                                          • Opcode Fuzzy Hash: 306ed4eafdf362f1a9668c7a7413176227ade94c4a4f11e8963c75f4ae46f6e1
                                                                                          • Instruction Fuzzy Hash: B041BF302087509AD324EB25C495BDEB7D1BB84714F508A1FF89A422D2DF7C568ACB8B
                                                                                          APIs
                                                                                          • GetParent.USER32(?), ref: 0041B644
                                                                                          • TrackMouseEvent.USER32 ref: 0041B693
                                                                                          • IsWindow.USER32(?), ref: 0041B6A1
                                                                                          • SendMessageW.USER32(?,00000198,?,00000000), ref: 0041B6EB
                                                                                          • InvalidateRect.USER32(?,?,00000001), ref: 0041B6F8
                                                                                          • SendMessageW.USER32(?,00000198,00000000,?), ref: 0041B73B
                                                                                          • InvalidateRect.USER32(?,?,00000001), ref: 0041B748
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: InvalidateMessageRectSend$EventMouseParentTrackWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2243617439-0
                                                                                          • Opcode ID: 7654f05ca271782a81d465001874bdc1e7e22eeab513fc1b3f8d1f090aeb1145
                                                                                          • Instruction ID: 8c226b3c77c7e8b8733cb63c2c9f6592de3c982c6c639516061dacb5e3a6317a
                                                                                          • Opcode Fuzzy Hash: 7654f05ca271782a81d465001874bdc1e7e22eeab513fc1b3f8d1f090aeb1145
                                                                                          • Instruction Fuzzy Hash: 3F315EB12007059FD624DF56C894E6BB3F8FB94705F00891EF98287380E775E945CBA5
                                                                                          APIs
                                                                                            • Part of subcall function 00448D2A: __EH_prolog.LIBCMT ref: 00448D2F
                                                                                            • Part of subcall function 00448D2A: lstrcpynW.KERNEL32(?,?,00000104,00000206,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,?,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 00448E1E
                                                                                            • Part of subcall function 00448E91: lstrlenW.KERNEL32(?,?,?,?,?,?,0040E5E0), ref: 00448E9B
                                                                                            • Part of subcall function 00448E91: GetFocus.USER32 ref: 00448EC3
                                                                                            • Part of subcall function 00448E91: IsWindowEnabled.USER32(?), ref: 00448EEC
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000000), ref: 00448EFE
                                                                                            • Part of subcall function 00448E91: GetOpenFileNameW.COMDLG32(?,?,?), ref: 00448F29
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000001), ref: 00448F47
                                                                                            • Part of subcall function 00448E91: IsWindow.USER32(?), ref: 00448F4D
                                                                                            • Part of subcall function 00448E91: SetFocus.USER32(?), ref: 00448F5B
                                                                                            • Part of subcall function 00448F79: __EH_prolog.LIBCMT ref: 00448F7E
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 00448FBB
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000464,00000104,00000000), ref: 00448FE3
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 0044900C
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000465,00000104,00000000), ref: 00449029
                                                                                            • Part of subcall function 00449145: __EH_prolog.LIBCMT ref: 0044914A
                                                                                          • DeleteFileW.KERNEL32(00000000,?,00000000), ref: 0040E64B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$H_prolog$EnableFileFocusMessageParentSend$DeleteEnabledNameOpenlstrcpynlstrlen
                                                                                          • String ID: %sconfig\.gmp$*.gmp$C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\$Gaming Mouse Profile(*.gmp)|*.gmp|$X
                                                                                          • API String ID: 659272761-3488602147
                                                                                          • Opcode ID: fa4b56c396d2af34e7dc9e512fc04bef3ec4f039b25577b70664eab97f08a35f
                                                                                          • Instruction ID: 74836d099113ae8f9ec7a9843a23fdce4fccebe66514ed6580cf4b26a755c22c
                                                                                          • Opcode Fuzzy Hash: fa4b56c396d2af34e7dc9e512fc04bef3ec4f039b25577b70664eab97f08a35f
                                                                                          • Instruction Fuzzy Hash: AD419174408380AFE325EB55C855FAEB7E8BB94708F04891EF49D432D2DB79A209CB17
                                                                                          APIs
                                                                                          • ClientToScreen.USER32(?,?), ref: 00416D13
                                                                                          • ScreenToClient.USER32(?,?), ref: 00416D25
                                                                                          • PostMessageW.USER32(?,00000450,?,?), ref: 00416D7D
                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00416D87
                                                                                          • PostMessageW.USER32(000104EA,00000465,00000001,00000000), ref: 00416DC6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClientMessagePostScreen$InvalidateRect
                                                                                          • String ID: GG
                                                                                          • API String ID: 3016096773-2425131523
                                                                                          • Opcode ID: 43a23cbe87bb7be3957f2df4296f3096f35a970528665a9c244e7403d4f7120c
                                                                                          • Instruction ID: 6d64334f26165cbc2e13616f12839c353b74a31ba5b9c18667326448bb94557f
                                                                                          • Opcode Fuzzy Hash: 43a23cbe87bb7be3957f2df4296f3096f35a970528665a9c244e7403d4f7120c
                                                                                          • Instruction Fuzzy Hash: DB315871300705AFE624CF6ADC81A57B3E9BB88705F00892EF685C7390EA74F8458B68
                                                                                          APIs
                                                                                          • GetWindow.USER32(?,00000002), ref: 00438453
                                                                                          • GetParent.USER32(?), ref: 00438466
                                                                                          • GetWindow.USER32(?,00000002), ref: 00438489
                                                                                          • GetWindow.USER32(?,00000002), ref: 0043849B
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 004384AB
                                                                                          • IsWindowVisible.USER32(?), ref: 004384C4
                                                                                          • GetTopWindow.USER32(?), ref: 004384EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$LongParentVisible
                                                                                          • String ID:
                                                                                          • API String ID: 506644340-0
                                                                                          • Opcode ID: 87ac5a30ea8019dc16bd96af8f3512c80605cc4a283e2169e6edc9f7ed0b209b
                                                                                          • Instruction ID: d74d641bc5411143e852696f0d00e127871c7dc77de629c036d2a4d786d2f9fa
                                                                                          • Opcode Fuzzy Hash: 87ac5a30ea8019dc16bd96af8f3512c80605cc4a283e2169e6edc9f7ed0b209b
                                                                                          • Instruction Fuzzy Hash: 6921B672600B156BDB316F669C09F2BB29CDF48754F05051EFD0197651EB29EC11C7A8
                                                                                          APIs
                                                                                          • SysAllocString.OLEAUT32(?), ref: 00455A9B
                                                                                            • Part of subcall function 0045054C: LoadStringW.USER32(?,?,?,?), ref: 00450563
                                                                                          • SysAllocString.OLEAUT32(?), ref: 00455AAA
                                                                                          • SysAllocString.OLEAUT32(?), ref: 00455AF0
                                                                                          • SysAllocString.OLEAUT32(?), ref: 00455B04
                                                                                          • SysAllocString.OLEAUT32(?), ref: 00455B21
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: String$Alloc$Load
                                                                                          • String ID: 6F
                                                                                          • API String ID: 3862620831-4069712204
                                                                                          • Opcode ID: ac9abfbe126c9e63d1966228f1a369681feb9cde19f021dd60baf446eda309bb
                                                                                          • Instruction ID: 336c29d6fe87850f061114cfa1209e3bce255b9669c2d8cbadacee1544e4ec04
                                                                                          • Opcode Fuzzy Hash: ac9abfbe126c9e63d1966228f1a369681feb9cde19f021dd60baf446eda309bb
                                                                                          • Instruction Fuzzy Hash: 4F318E70600B00AFD721DF25C885A6AB7E4BF44302F10852FE85997652E778E884CB99
                                                                                          APIs
                                                                                          • GetWindowRect.USER32(?), ref: 00446C50
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 00446C59
                                                                                          • InflateRect.USER32(?,00000001,00000001), ref: 00446CB8
                                                                                          • GetParent.USER32(?), ref: 00446CBF
                                                                                          • ScreenToClient.USER32(00000000,?), ref: 00446CD3
                                                                                          • ScreenToClient.USER32(00000000,?), ref: 00446CDB
                                                                                          • InvalidateRect.USER32(00000000,?,00000000), ref: 00446CF1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Rect$ClientScreenWindow$InflateInvalidateLongParent
                                                                                          • String ID:
                                                                                          • API String ID: 1809568455-0
                                                                                          • Opcode ID: 1fa8278e568bfc5f4e58737a58df4491ec26f5bb4f44084b6f60c29278a75480
                                                                                          • Instruction ID: ee5afe6a5afec09db27894840a7597b36f436d358638ba8c68b429394d5ed8a5
                                                                                          • Opcode Fuzzy Hash: 1fa8278e568bfc5f4e58737a58df4491ec26f5bb4f44084b6f60c29278a75480
                                                                                          • Instruction Fuzzy Hash: 9B218B31204305AFE718DF65D8D4F7B73A9EB81761F01092EF99682291E738D905CB26
                                                                                          APIs
                                                                                          • RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 00454476
                                                                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 00454499
                                                                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 004544B8
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 004544C8
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 004544D2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreate$Open
                                                                                          • String ID: software
                                                                                          • API String ID: 1740278721-2010147023
                                                                                          • Opcode ID: f2638908c3d76209b4b62c780d266dad48b59e74b91dbe9c922179563a4b7b4b
                                                                                          • Instruction ID: fcd4a6b995252bb93336779f366ab1244c32ed2fa505d097813b595925f2dc25
                                                                                          • Opcode Fuzzy Hash: f2638908c3d76209b4b62c780d266dad48b59e74b91dbe9c922179563a4b7b4b
                                                                                          • Instruction Fuzzy Hash: 9411E672900118FBCB21CF96CC84DEFFFBCEFC5705B1040AAA904A2122D2759A44DB64
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: H_prolog
                                                                                          • String ID: 3F$<3F$@4F$h3F$|3F
                                                                                          • API String ID: 3519838083-2544270256
                                                                                          • Opcode ID: df7d0aeb20fea9f84f1430d496e830abcbc771cbaab12ce622a6de8126421952
                                                                                          • Instruction ID: 61e2581b4e709c1ec52a211c1a6a7186738a8fd5f7cd3badf6492e461d5227c5
                                                                                          • Opcode Fuzzy Hash: df7d0aeb20fea9f84f1430d496e830abcbc771cbaab12ce622a6de8126421952
                                                                                          • Instruction Fuzzy Hash: 44219FB0901B449ED320CF2AC445786FBE8FFA5319F008A1FD5AA87761DBB46548CF5A
                                                                                          APIs
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 00446D0D
                                                                                          • GetWindowRect.USER32(?,?), ref: 00446D1B
                                                                                          • InflateRect.USER32(?,00000001,00000001), ref: 00446D2A
                                                                                          • GetParent.USER32(?), ref: 00446D31
                                                                                          • ScreenToClient.USER32(00000000,?), ref: 00446D45
                                                                                          • ScreenToClient.USER32(00000000,?), ref: 00446D4D
                                                                                          • ValidateRect.USER32(00000000,?), ref: 00446D61
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Rect$ClientScreenWindow$InflateLongParentValidate
                                                                                          • String ID:
                                                                                          • API String ID: 2275295265-0
                                                                                          • Opcode ID: b5fd468a5165253c7230d16e0770c2fdba8c3614279dc359b93a66fbe42711cc
                                                                                          • Instruction ID: 57aca44f65aee822d3ad4ffbbac329ee867fac9b15dbe95b75fd84cc0af6bdc8
                                                                                          • Opcode Fuzzy Hash: b5fd468a5165253c7230d16e0770c2fdba8c3614279dc359b93a66fbe42711cc
                                                                                          • Instruction Fuzzy Hash: DAF08132104305BFE7059B65DC88DBF77BCEB85726F004529F91592192E734EA0A8B66
                                                                                          APIs
                                                                                          • GetSysColor.USER32(0000000F), ref: 00450438
                                                                                          • GetSysColor.USER32(00000010), ref: 0045043F
                                                                                          • GetSysColor.USER32(00000014), ref: 00450446
                                                                                          • GetSysColor.USER32(00000012), ref: 0045044D
                                                                                          • GetSysColor.USER32(00000006), ref: 00450454
                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 00450461
                                                                                          • GetSysColorBrush.USER32(00000006), ref: 00450468
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Color$Brush
                                                                                          • String ID:
                                                                                          • API String ID: 2798902688-0
                                                                                          • Opcode ID: 1b7bd99d15d84f6782c089c5b79118edcd407657e46483cc389f4682ba91c6fc
                                                                                          • Instruction ID: d94f4600b4dc3ad9470a5cf930f662dd93fa1478ae3ea189350054ba6e15636b
                                                                                          • Opcode Fuzzy Hash: 1b7bd99d15d84f6782c089c5b79118edcd407657e46483cc389f4682ba91c6fc
                                                                                          • Instruction Fuzzy Hash: DEF0F8719407489BE720AFB29D49B47BAE4FFC4B10F02092ED2858BA90E6B5E4009F44
                                                                                          APIs
                                                                                          • GetStringTypeW.KERNEL32(00000001,00496580,00000001,?,?,?,?,?,?,?,?,00439D56,?), ref: 0044339E
                                                                                          • GetStringTypeA.KERNEL32(00000000,00000001,0046460C,00000001,?,?,?,?,?,?,?,00439D56,?), ref: 004433B8
                                                                                          • GetStringTypeA.KERNEL32(?,00439D56,?,?,?,?,?,?,?,?,?,?,00439D56,?), ref: 004433EC
                                                                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,00439D56,?), ref: 00443424
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00439D56), ref: 0044347A
                                                                                          • GetStringTypeW.KERNEL32(00439D56,?,00000000,?,?,?,?,?,?,?,?,?,?,00439D56), ref: 0044348C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: StringType$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 3852931651-0
                                                                                          • Opcode ID: 79da2bad4930d9228e4d9071096bfe765287aa7cf59f7d4653e476a4732d9ba4
                                                                                          • Instruction ID: 0cf9d1f3640b0d93382ea20e7d8ff8c2858043b2e89c577d94622877d5970b8b
                                                                                          • Opcode Fuzzy Hash: 79da2bad4930d9228e4d9071096bfe765287aa7cf59f7d4653e476a4732d9ba4
                                                                                          • Instruction Fuzzy Hash: B3419E72600209AFDF21DF99DC85EEF7F79EB09B55F20442AF905D2250D7388A50CBA9
                                                                                          APIs
                                                                                          • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0041997A
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 00419994
                                                                                          • SelectObject.GDI32(?,?), ref: 004199B5
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004199C3
                                                                                          • SelectObject.GDI32(?,?), ref: 004199E8
                                                                                          • StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00419A19
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CompatibleCreate$ObjectSelect$BitmapStretch
                                                                                          • String ID:
                                                                                          • API String ID: 3934088380-0
                                                                                          • Opcode ID: 322f48083d727485a449175e679a6409123ebf3ac406ee27032b970be0aaa77b
                                                                                          • Instruction ID: ac40ee8867f34f3cab20dc0e54f6ebfc2b5d6f4c69c2487000c1bc232bc56daf
                                                                                          • Opcode Fuzzy Hash: 322f48083d727485a449175e679a6409123ebf3ac406ee27032b970be0aaa77b
                                                                                          • Instruction Fuzzy Hash: 87419075204341ABC314DF55C895F6BB7E8BF89701F04491DF99683292DB78EC08CB65
                                                                                          APIs
                                                                                          • TlsGetValue.KERNEL32(00498528,004982A4,00000000,?,00498528,?,00454057,004982A4,00000000,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36), ref: 00453DFA
                                                                                          • EnterCriticalSection.KERNEL32(00498544,00000010,?,00498528,?,00454057,004982A4,00000000,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36), ref: 00453E49
                                                                                          • LeaveCriticalSection.KERNEL32(00498544,00000000,?,00498528,?,00454057,004982A4,00000000,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36), ref: 00453E5C
                                                                                          • LocalAlloc.KERNEL32(00000000,00000004,?,00498528,?,00454057,004982A4,00000000,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36), ref: 00453E72
                                                                                          • LocalReAlloc.KERNEL32(?,00000004,00000002,?,00498528,?,00454057,004982A4,00000000,?,00000000,00453494,00452F3F,004534B0,0044ECC0,00450B36), ref: 00453E84
                                                                                          • TlsSetValue.KERNEL32(00498528,00000000), ref: 00453EC0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocCriticalLocalSectionValue$EnterLeave
                                                                                          • String ID:
                                                                                          • API String ID: 4117633390-0
                                                                                          • Opcode ID: c98f7b9f76d24b16008c71b032f6c21bf283630e2fa5466bd10a2103570eeb9a
                                                                                          • Instruction ID: e6c81e2ec5ef9afb09c5e9099c8f5a04f0989c9593ea60c34970a490921d5da7
                                                                                          • Opcode Fuzzy Hash: c98f7b9f76d24b16008c71b032f6c21bf283630e2fa5466bd10a2103570eeb9a
                                                                                          • Instruction Fuzzy Hash: 88319F71100605EFD728CF15C846F6AB7E8FB44396F00852AE81AC7692DB74EA09CB65
                                                                                          APIs
                                                                                          • PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00448078
                                                                                          • GetWindowTextLengthA.USER32(?), ref: 00448082
                                                                                          • GetWindowTextA.USER32(?,00000000,00000000), ref: 004480AA
                                                                                          • SetTextColor.GDI32(?,?), ref: 004480EB
                                                                                          • DrawTextA.USER32(?,00000000,000000FF,?,?), ref: 00448103
                                                                                          • SetTextColor.GDI32(?,?), ref: 00448115
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Text$ColorWindow$DrawLength
                                                                                          • String ID:
                                                                                          • API String ID: 1177705772-0
                                                                                          • Opcode ID: 5b2087d91884acdcc5eeaa82cb0e76dc920dbb36b9dbfd502b7d1ac4d7e6447d
                                                                                          • Instruction ID: 858b00ab833469fa07d25e22e37e02ead8fc158abe8c28e85412cd5e13781d8e
                                                                                          • Opcode Fuzzy Hash: 5b2087d91884acdcc5eeaa82cb0e76dc920dbb36b9dbfd502b7d1ac4d7e6447d
                                                                                          • Instruction Fuzzy Hash: 9B216D76600208AFE714CF59DC85EBB77A9EB88311F14816AFD5993391DA34EE01CB64
                                                                                          APIs
                                                                                          • GetWindow.USER32(?,00000002), ref: 00438453
                                                                                          • GetParent.USER32(?), ref: 00438466
                                                                                          • GetWindow.USER32(?,00000002), ref: 00438489
                                                                                          • GetWindow.USER32(?,00000002), ref: 0043849B
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 004384AB
                                                                                          • IsWindowVisible.USER32(?), ref: 004384C4
                                                                                          • GetTopWindow.USER32(?), ref: 004384EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$LongParentVisible
                                                                                          • String ID:
                                                                                          • API String ID: 506644340-0
                                                                                          • Opcode ID: 0ebe9b138d9c61c4ab2a0b30fc9622c20c325fbc5d6b9c958c047461af86f825
                                                                                          • Instruction ID: 7ef162064987fe8aab6a3270117c165679a730d351a7653377fad3464b6cb0c4
                                                                                          • Opcode Fuzzy Hash: 0ebe9b138d9c61c4ab2a0b30fc9622c20c325fbc5d6b9c958c047461af86f825
                                                                                          • Instruction Fuzzy Hash: 8A11B4726007156FD7316FA29C49F2BF29CDF58754F04051EFC4197682EB28EC01C6A8
                                                                                          APIs
                                                                                          • GetParent.USER32(?), ref: 00452219
                                                                                          • GetLastActivePopup.USER32(?), ref: 00452228
                                                                                          • IsWindowEnabled.USER32(?), ref: 0045223D
                                                                                          • EnableWindow.USER32(?,00000000), ref: 00452250
                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00452262
                                                                                          • GetParent.USER32(?), ref: 00452270
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
                                                                                          • String ID:
                                                                                          • API String ID: 670545878-0
                                                                                          • Opcode ID: 4a49c26bf60fd8e4deadb9a2e28f263f53539e8e3917f0c608dd1642a05c07b7
                                                                                          • Instruction ID: e145e211fc7aed1fc5b21bbca81fce2d46677183ecf5a3677e5b9b1554b5c583
                                                                                          • Opcode Fuzzy Hash: 4a49c26bf60fd8e4deadb9a2e28f263f53539e8e3917f0c608dd1642a05c07b7
                                                                                          • Instruction Fuzzy Hash: EB11CA36705325578B311AAA4E44B3B72985F67B53F0941A7FD00E7307E7E8CD0546AE
                                                                                          APIs
                                                                                          • GetCommandLineW.KERNEL32(?,00000000,?,?,00439127), ref: 0043C41B
                                                                                          • GetCommandLineA.KERNEL32(?,00000000,?,?,00439127), ref: 0043C42D
                                                                                          • GetCommandLineW.KERNEL32(?,00000000,?,?,00439127), ref: 0043C444
                                                                                          • GetCommandLineA.KERNEL32(?,00000000,?,?,00439127), ref: 0043C44D
                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00000000,?,00000000,?,?,00439127), ref: 0043C466
                                                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,000000FF,00000000,00000000,?,00000000,?,?,00439127), ref: 0043C48B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CommandLine$ByteCharMultiWide
                                                                                          • String ID:
                                                                                          • API String ID: 3068183746-0
                                                                                          • Opcode ID: 1aab0457b98b65059c80293f355a62e5a1a803f8288062c11fef5b672adface6
                                                                                          • Instruction ID: bc8a9ec7be59b118e21848a24874dec27402925fd3959bafeac29c5ce636a3c8
                                                                                          • Opcode Fuzzy Hash: 1aab0457b98b65059c80293f355a62e5a1a803f8288062c11fef5b672adface6
                                                                                          • Instruction Fuzzy Hash: E011A1722047296AEA20AB6DACD1B3B368CDB69774F311137F510E2290DAA9DC41477D
                                                                                          APIs
                                                                                          • SetCapture.USER32(?,?,?,?,?,0040AFD0,00000001,00474CF0), ref: 0040E16A
                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 0040E183
                                                                                          • SetCursor.USER32(00000000,?,?,?,?,0040AFD0,00000001,00474CF0), ref: 0040E186
                                                                                            • Part of subcall function 0040F2F0: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,0040E195,00000000,?,?,?,?,0040AFD0,00000001), ref: 0040F31B
                                                                                            • Part of subcall function 0040F2F0: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,0040E195,00000000,?,?,?,?,0040AFD0,00000001), ref: 0040F339
                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 0040E20C
                                                                                          • SetCursor.USER32(00000000), ref: 0040E20F
                                                                                          • ReleaseCapture.USER32 ref: 0040E215
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Cursor$CaptureLoadRedrawWindow$Release
                                                                                          • String ID:
                                                                                          • API String ID: 124967584-0
                                                                                          • Opcode ID: 7dae2c3acd70c6c593f18cc69dd45021e1b3f351c219603455ccd30027917bd1
                                                                                          • Instruction ID: d56769151460a48116961935b89e862239b9fd0820af609b5d2f1b31eb6d0473
                                                                                          • Opcode Fuzzy Hash: 7dae2c3acd70c6c593f18cc69dd45021e1b3f351c219603455ccd30027917bd1
                                                                                          • Instruction Fuzzy Hash: F2018672B8030467E6047BA76C47F6F21059B84B09F51443EFA0A6B2C3EE7DAD0442AD
                                                                                          APIs
                                                                                          • ClientToScreen.USER32(?,?), ref: 00451CD3
                                                                                          • GetWindow.USER32(?,00000005), ref: 00451CE4
                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 00451CED
                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 00451CFC
                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00451D0E
                                                                                          • PtInRect.USER32(?,?,?), ref: 00451D1E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Rect$ClientCtrlLongScreen
                                                                                          • String ID:
                                                                                          • API String ID: 1315500227-0
                                                                                          • Opcode ID: 1315e6bb7b50333b28d8c758698928605459b4207431d15e165afef5da7caba8
                                                                                          • Instruction ID: 854f77f4ee0d7dff2f17eaa73f4c45ed4157d621cb76140b7adcb763f0748a83
                                                                                          • Opcode Fuzzy Hash: 1315e6bb7b50333b28d8c758698928605459b4207431d15e165afef5da7caba8
                                                                                          • Instruction Fuzzy Hash: 61018F31100219BBDB129BA59C08FAF777CEF05346F004536FD21D5162E738EA1A8B99
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00435B60
                                                                                          • CoTaskMemAlloc.OLE32(?,?,?,00000000), ref: 00435C7C
                                                                                          • CoTaskMemFree.OLE32(?,?,00000000), ref: 00435E63
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Task$AllocFreeH_prolog
                                                                                          • String ID: $(
                                                                                          • API String ID: 1522537378-55695022
                                                                                          • Opcode ID: f8be7f7f620106efdf9748419c6153c06072444c7f352525dc1c75b147fa7cf9
                                                                                          • Instruction ID: a8c34b399e40925cb75223c485326fdde5849360710a029382f221edd524544f
                                                                                          • Opcode Fuzzy Hash: f8be7f7f620106efdf9748419c6153c06072444c7f352525dc1c75b147fa7cf9
                                                                                          • Instruction Fuzzy Hash: A5B11570A007099FCB14DFA9C885AAEFBF5FF88304F24495EE016EB251D7B4A945CB64
                                                                                          APIs
                                                                                          • LoadStringW.USER32(10000000,000003F2,?,00000104), ref: 004118E6
                                                                                          • RedrawWindow.USER32(00000000,00000000,00000000,00000105,?,00000000,00474614,?,?,?,0045F15C), ref: 00412153
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LoadRedrawStringWindow
                                                                                          • String ID: Alt+$Ctrl+$Win+
                                                                                          • API String ID: 1390970911-1120252461
                                                                                          • Opcode ID: 2fb790fbb440a9101209f51231ce93d346daae821ca028f61726bf1a699def5f
                                                                                          • Instruction ID: 5980ff561b5cf15db677988084312613c883a27ae823ae4764e019598e3bb5a5
                                                                                          • Opcode Fuzzy Hash: 2fb790fbb440a9101209f51231ce93d346daae821ca028f61726bf1a699def5f
                                                                                          • Instruction Fuzzy Hash: 7791B470108341AFE314DB55C981FEBB7E8BBD4B08F40491EF685462D2DBB9A649CB27
                                                                                          APIs
                                                                                            • Part of subcall function 0043D7A4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00440494,00000009,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 0043D7E1
                                                                                            • Part of subcall function 0043D7A4: EnterCriticalSection.KERNEL32(?,?,?,00440494,00000009,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 0043D7FC
                                                                                            • Part of subcall function 0043D805: LeaveCriticalSection.KERNEL32(?,00439F5E,00000009,?,00000009,00000000,?,00439F1E,000000E0,00439F0B,?,0043D7C4,00000018,00000000,?), ref: 0043D812
                                                                                          • GetTimeZoneInformation.KERNEL32(0000000C,?,0000000C,?,0000000B,0000000B,?,0044109C,0043B6C9), ref: 004410F9
                                                                                          • WideCharToMultiByte.KERNEL32(00000220,00498B94,000000FF,0000003F,00000000,?,?,0000000B,0000000B,?,0044109C,0043B6C9), ref: 0044118F
                                                                                          • WideCharToMultiByte.KERNEL32(00000220,00498BE8,000000FF,0000003F,00000000,?,?,0000000B,0000000B,?,0044109C,0043B6C9), ref: 004411C8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$ByteCharMultiWide$EnterInformationInitializeLeaveTimeZone
                                                                                          • String ID: ,>G$l>G
                                                                                          • API String ID: 3442286286-2251467633
                                                                                          • Opcode ID: 6421930a40b966fb74fa6e03983347e8babbbe858369b1e412d6346edb271f8b
                                                                                          • Instruction ID: a83e41d5ebe7b2f834b5cf9373374f582b50cdeb5c3fe63ba95fcff0b2878748
                                                                                          • Opcode Fuzzy Hash: 6421930a40b966fb74fa6e03983347e8babbbe858369b1e412d6346edb271f8b
                                                                                          • Instruction Fuzzy Hash: 33610471904240AEF721AF29EC41B6A7FA8BB0A315F18017FE445D62F1D7B84EC2971D
                                                                                          APIs
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                            • Part of subcall function 0044E5BA: lstrlenA.KERNEL32(?,00000000,?,00000000,0043649B,0000001C), ref: 0044E5CF
                                                                                          • RedrawWindow.USER32(00000000,00000000,00000000,00000105,?,00000000,00474614,?,?,?,0045F15C), ref: 00412153
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedRedrawWindowlstrlen
                                                                                          • String ID: Alt+$Ctrl+$Shift+$Win+
                                                                                          • API String ID: 2129315304-4196241628
                                                                                          • Opcode ID: 709b93a9b519fa754f3b67a4dbeda1f5ccca2ea78ad3d6cc7b518cf4c3a58b96
                                                                                          • Instruction ID: 364931efc12b4ba209b77ab05db0549d2a0bd5406763a2935b8277924328aad9
                                                                                          • Opcode Fuzzy Hash: 709b93a9b519fa754f3b67a4dbeda1f5ccca2ea78ad3d6cc7b518cf4c3a58b96
                                                                                          • Instruction Fuzzy Hash: B1516F300093819EE315EB66C591BDFBBE5AFE4708F448A4EF4C902292EF796509C767
                                                                                          APIs
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                            • Part of subcall function 0044E5BA: lstrlenA.KERNEL32(?,00000000,?,00000000,0043649B,0000001C), ref: 0044E5CF
                                                                                          • RedrawWindow.USER32(?,00000000,00000000,00000105,?,00474614), ref: 004131F0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DecrementInterlockedRedrawWindowlstrlen
                                                                                          • String ID: Alt+$Ctrl+$Shift+$Win+
                                                                                          • API String ID: 2129315304-4196241628
                                                                                          • Opcode ID: d991b474437798bcb60fb786aa8d6a6d535de69022c2cb9ad08abf1a9d0bebad
                                                                                          • Instruction ID: 0880cc4b2b693860acc77889315bbe2a83b51721c533f7fad7ca017dd614f2a7
                                                                                          • Opcode Fuzzy Hash: d991b474437798bcb60fb786aa8d6a6d535de69022c2cb9ad08abf1a9d0bebad
                                                                                          • Instruction Fuzzy Hash: 5E516D700083819EE325EB66C491BEBBBE5AFD4708F044A0EF4C9122D2DA796558CB27
                                                                                          APIs
                                                                                          • GetPropW.USER32(?,CoolMenu_oldProc), ref: 0042164E
                                                                                          • CallWindowProcW.USER32(00000000,?,?,?,?), ref: 0042169B
                                                                                          • CallWindowProcW.USER32(00000000,?,00000083,?,?), ref: 004216D7
                                                                                          • CallWindowProcW.USER32(00000000,?,00000317,?,?), ref: 0042171E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CallProcWindow$Prop
                                                                                          • String ID: CoolMenu_oldProc
                                                                                          • API String ID: 2054270997-20242104
                                                                                          • Opcode ID: 1268258f8498c716e14cb702ff62d3769efe89fed3a523f92046d28f2e7c02c4
                                                                                          • Instruction ID: 549e616155f3537a1187496d318230738d85faea7b3f00f9dc563f5fe524c2ad
                                                                                          • Opcode Fuzzy Hash: 1268258f8498c716e14cb702ff62d3769efe89fed3a523f92046d28f2e7c02c4
                                                                                          • Instruction Fuzzy Hash: AE31072670022427D610A665BC8497F238DEFE53A9F48443BF941C2262EA1DDD1442BE
                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00426448
                                                                                            • Part of subcall function 004259C0: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000), ref: 00425A3E
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileModuleName$DecrementInterlocked
                                                                                          • String ID: OSDSetting$config$config.ini$option
                                                                                          • API String ID: 602921821-754152410
                                                                                          • Opcode ID: 9d9a7ced819e587d11d1d281c5053e41d935e51ad284f161ad04ed84dff61753
                                                                                          • Instruction ID: 5b0df07cef907b27e6cc821ffd18538c52f7b61b8a036df5fa70d0996a442a95
                                                                                          • Opcode Fuzzy Hash: 9d9a7ced819e587d11d1d281c5053e41d935e51ad284f161ad04ed84dff61753
                                                                                          • Instruction Fuzzy Hash: 054146B0109380AEE324EB65C952BDFB7E8AFD4718F40491DF58D52282DB78A508C76B
                                                                                          APIs
                                                                                          • SendMessageW.USER32(00000000,00000433,00000000,?), ref: 0044BA74
                                                                                          • GetWindowLongW.USER32(?,000000FC), ref: 0044BA85
                                                                                          • GetWindowLongW.USER32(?,000000FC), ref: 0044BA95
                                                                                          • SetWindowLongW.USER32(?,000000FC,?), ref: 0044BAB1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LongWindow$MessageSend
                                                                                          • String ID: (
                                                                                          • API String ID: 2178440468-3887548279
                                                                                          • Opcode ID: 6f126d84e2a5cab9cc10af10ef0ae9506a9f88b41b9796af821cc54f52873b66
                                                                                          • Instruction ID: 850985cc960ab1f06ca3ef7e2968c42ea28f73798b13da0deeeae5078745c541
                                                                                          • Opcode Fuzzy Hash: 6f126d84e2a5cab9cc10af10ef0ae9506a9f88b41b9796af821cc54f52873b66
                                                                                          • Instruction Fuzzy Hash: BA3192316007009FEB21AF66D884B6EB7B4FF04315F14466EE542A7792DB78E905CBD8
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FreeString$ClearVariant
                                                                                          • String ID: `<u
                                                                                          • API String ID: 3349467263-3367579956
                                                                                          • Opcode ID: 818d69b1cd84a7c343f394c86d644fc6743acd30dd86e6c1a44ed74c02bd1857
                                                                                          • Instruction ID: 4ca3c520c0cafa825035f7e314369ee31570b608f9d721fa3e805b6ab4b79978
                                                                                          • Opcode Fuzzy Hash: 818d69b1cd84a7c343f394c86d644fc6743acd30dd86e6c1a44ed74c02bd1857
                                                                                          • Instruction Fuzzy Hash: E6316D71A11618BFCB04DFA5D884EDEBBB8FF18716F50811AF508A7240D778A984CFA4
                                                                                          APIs
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 004545C2
                                                                                            • Part of subcall function 004546B0: lstrlenW.KERNEL32(?,004545F3,?,?), ref: 004546E4
                                                                                          • lstrcpyW.KERNEL32(?,.HLP,?,?,00000104), ref: 00454663
                                                                                          • lstrcatW.KERNEL32(?,.INI,?,?,00000104), ref: 00454692
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileModuleNamelstrcatlstrcpylstrlen
                                                                                          • String ID: .HLP$.INI
                                                                                          • API String ID: 2421895198-3011182340
                                                                                          • Opcode ID: 9ab84e88138c7f5c35af378d596f672495e9d0caae3cff9a48ebb65b7909fa43
                                                                                          • Instruction ID: 9469df993c96ff54655bbc87cc5a7d3e12b9c76abbd35565f533f158b01fa574
                                                                                          • Opcode Fuzzy Hash: 9ab84e88138c7f5c35af378d596f672495e9d0caae3cff9a48ebb65b7909fa43
                                                                                          • Instruction Fuzzy Hash: 813184B1400718AFDB20DF75D885B86B7FCEB48305F10486BE559D3152EB34A9848B29
                                                                                          APIs
                                                                                          • SHGetSpecialFolderPathW.SHELL32 ref: 0041B080
                                                                                            • Part of subcall function 00448D2A: __EH_prolog.LIBCMT ref: 00448D2F
                                                                                            • Part of subcall function 00448D2A: lstrcpynW.KERNEL32(?,?,00000104,00000206,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,?,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 00448E1E
                                                                                            • Part of subcall function 00448E91: lstrlenW.KERNEL32(?,?,?,?,?,?,0040E5E0), ref: 00448E9B
                                                                                            • Part of subcall function 00448E91: GetFocus.USER32 ref: 00448EC3
                                                                                            • Part of subcall function 00448E91: IsWindowEnabled.USER32(?), ref: 00448EEC
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000000), ref: 00448EFE
                                                                                            • Part of subcall function 00448E91: GetOpenFileNameW.COMDLG32(?,?,?), ref: 00448F29
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000001), ref: 00448F47
                                                                                            • Part of subcall function 00448E91: IsWindow.USER32(?), ref: 00448F4D
                                                                                            • Part of subcall function 00448E91: SetFocus.USER32(?), ref: 00448F5B
                                                                                            • Part of subcall function 00448F79: __EH_prolog.LIBCMT ref: 00448F7E
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 00448FBB
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000464,00000104,00000000), ref: 00448FE3
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 0044900C
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000465,00000104,00000000), ref: 00449029
                                                                                            • Part of subcall function 00449145: __EH_prolog.LIBCMT ref: 0044914A
                                                                                            • Part of subcall function 0044DB1E: SetWindowTextW.USER32(?,?), ref: 0044DB2C
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$H_prolog$EnableFocusMessageParentSend$DecrementEnabledFileFolderInterlockedNameOpenPathSpecialTextlstrcpynlstrlen
                                                                                          • String ID: %s\.exe$*.exe$X$exe file(*.exe)|*.EXE|
                                                                                          • API String ID: 50889835-2107605243
                                                                                          • Opcode ID: 6d4a654cb26e8a5d2f90c32b02250ab62cb16f854f0c37750ba7942dedadfbfa
                                                                                          • Instruction ID: cff78a9108b6ba0946f3de40ea0351daaa1a5c3ec20ce8eb655a1632bc501e14
                                                                                          • Opcode Fuzzy Hash: 6d4a654cb26e8a5d2f90c32b02250ab62cb16f854f0c37750ba7942dedadfbfa
                                                                                          • Instruction Fuzzy Hash: 91314F71008BC19EE324EB19CD66BAFB7D4AB94709F04490EF599422C2DBB86548CF17
                                                                                          APIs
                                                                                          • SHGetSpecialFolderPathW.SHELL32 ref: 00419360
                                                                                            • Part of subcall function 00448D2A: __EH_prolog.LIBCMT ref: 00448D2F
                                                                                            • Part of subcall function 00448D2A: lstrcpynW.KERNEL32(?,?,00000104,00000206,Gaming Mouse Profile(*.gmp)|*.gmp|,00000000,?,%sconfig\.gmp,C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\), ref: 00448E1E
                                                                                            • Part of subcall function 00448E91: lstrlenW.KERNEL32(?,?,?,?,?,?,0040E5E0), ref: 00448E9B
                                                                                            • Part of subcall function 00448E91: GetFocus.USER32 ref: 00448EC3
                                                                                            • Part of subcall function 00448E91: IsWindowEnabled.USER32(?), ref: 00448EEC
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000000), ref: 00448EFE
                                                                                            • Part of subcall function 00448E91: GetOpenFileNameW.COMDLG32(?,?,?), ref: 00448F29
                                                                                            • Part of subcall function 00448E91: EnableWindow.USER32(?,00000001), ref: 00448F47
                                                                                            • Part of subcall function 00448E91: IsWindow.USER32(?), ref: 00448F4D
                                                                                            • Part of subcall function 00448E91: SetFocus.USER32(?), ref: 00448F5B
                                                                                            • Part of subcall function 00448F79: __EH_prolog.LIBCMT ref: 00448F7E
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 00448FBB
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000464,00000104,00000000), ref: 00448FE3
                                                                                            • Part of subcall function 00448F79: GetParent.USER32(?), ref: 0044900C
                                                                                            • Part of subcall function 00448F79: SendMessageW.USER32(?,00000465,00000104,00000000), ref: 00449029
                                                                                            • Part of subcall function 00449145: __EH_prolog.LIBCMT ref: 0044914A
                                                                                            • Part of subcall function 0044DB1E: SetWindowTextW.USER32(?,?), ref: 0044DB2C
                                                                                            • Part of subcall function 0044E4F1: InterlockedDecrement.KERNEL32(-000000F4), ref: 0044E505
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$H_prolog$EnableFocusMessageParentSend$DecrementEnabledFileFolderInterlockedNameOpenPathSpecialTextlstrcpynlstrlen
                                                                                          • String ID: %s\.exe$*.exe$X$exe file(*.exe)|*.EXE|
                                                                                          • API String ID: 50889835-2107605243
                                                                                          • Opcode ID: 4867f76f78225555b56593f5c80755cd4cc15632fa5a418085227dcdd3afb445
                                                                                          • Instruction ID: 5a4ac4e61f5788ac1a58a94f564a0c15d7cdc9fbee6e64ed8b460db3d0d1129e
                                                                                          • Opcode Fuzzy Hash: 4867f76f78225555b56593f5c80755cd4cc15632fa5a418085227dcdd3afb445
                                                                                          • Instruction Fuzzy Hash: A13140700087C19EE324EB19CC65BABB7D4AB94709F04490DF599422C2DB7C654CCF17
                                                                                          APIs
                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0044A5BF
                                                                                          • GetDlgItem.USER32(?,00000002), ref: 0044A5DE
                                                                                          • IsWindowEnabled.USER32(00000000), ref: 0044A5E9
                                                                                          • SendMessageW.USER32(?,00000111,00000002,00000000), ref: 0044A5FF
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$EnabledItemLongMessageSend
                                                                                          • String ID: Edit
                                                                                          • API String ID: 3499652902-554135844
                                                                                          • Opcode ID: c37c8cfd4ef9c703acc6786ce78fe56f78b5561cffb4496a6f69c52f3e320ea5
                                                                                          • Instruction ID: bf9f6b95696049fab7008371f615ea6b65de5c41b0959f53f5f2c8c192446d4c
                                                                                          • Opcode Fuzzy Hash: c37c8cfd4ef9c703acc6786ce78fe56f78b5561cffb4496a6f69c52f3e320ea5
                                                                                          • Instruction Fuzzy Hash: 89010430388201BAFB245A228C09B6BB6A4AF64756F19442BF442D52E1DB78DCA1851F
                                                                                          APIs
                                                                                          • GetWindow.USER32(?,00000005), ref: 00445C15
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 00445C22
                                                                                          • SetTextColor.GDI32(?,?), ref: 00445C3F
                                                                                          • SetBkColor.GDI32(?,?), ref: 00445C4D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ColorWindow$LongText
                                                                                          • String ID: TgD
                                                                                          • API String ID: 3945788684-3489212311
                                                                                          • Opcode ID: 7d9b36096a3fd1ce629b152adca183c7417aac17814b8de44a9014027373fe45
                                                                                          • Instruction ID: af257b4f1239d180f7794777daa1e870de5bc37301fdcca5d3cdece2dc65ceec
                                                                                          • Opcode Fuzzy Hash: 7d9b36096a3fd1ce629b152adca183c7417aac17814b8de44a9014027373fe45
                                                                                          • Instruction Fuzzy Hash: 9F01D83610A7649BEF20DF64BC88AEF7754E762321B104837F441D2192D618A956C2AF
                                                                                          APIs
                                                                                            • Part of subcall function 0044E5BA: lstrlenA.KERNEL32(?,00000000,?,00000000,0043649B,0000001C), ref: 0044E5CF
                                                                                          • RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,?,?,004266EF), ref: 0042763F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: RedrawWindowlstrlen
                                                                                          • String ID: Real Player$Winamp$Windows Media player$iTunes
                                                                                          • API String ID: 518123097-696272918
                                                                                          • Opcode ID: e3a6cd365dc4662aa2faea0340ad100c89e4ea4bf3b42a84cbdfe3de655d9a90
                                                                                          • Instruction ID: 2e00ff9b898d9b4cfdc5db9e24b991cee57d41ba0129cecd666fd10459a2b5d3
                                                                                          • Opcode Fuzzy Hash: e3a6cd365dc4662aa2faea0340ad100c89e4ea4bf3b42a84cbdfe3de655d9a90
                                                                                          • Instruction Fuzzy Hash: 4911C430648710EBD224EF29DD42F9AB7A4FB40B24F508A1FF456522D1D7BCA5058B5F
                                                                                          APIs
                                                                                          • SetCapture.USER32(?), ref: 0041553D
                                                                                          • PostMessageW.USER32(?,0000046C,00000000,?), ref: 00415586
                                                                                          • ReleaseCapture.USER32 ref: 00415593
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Capture$MessagePostRelease
                                                                                          • String ID: ReleaseCapture $SetCapture
                                                                                          • API String ID: 3120302500-2815970145
                                                                                          • Opcode ID: fb1e064a62d4a50613ff5132e9f2bfe88c8ddf476b48af98dbba3980d91f56ac
                                                                                          • Instruction ID: c37298ec3e74f2c306f8f577395cbd35488cb1c51ff6fe9c92d63a0d059e89cc
                                                                                          • Opcode Fuzzy Hash: fb1e064a62d4a50613ff5132e9f2bfe88c8ddf476b48af98dbba3980d91f56ac
                                                                                          • Instruction Fuzzy Hash: 94012671900700ABD220EF69DC45EDB3768BF08725F044B2EF5A8862D2F739E814CB99
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: edfbd52e9ac53efb4a9a6369aa52d07d74c9dcc92654ccaf523fa8f5e4371dfc
                                                                                          • Instruction ID: bd9dfd78c0030e0bfdfc6f5a8e26ad64ebdf6c08c28d2edd1765b55603431454
                                                                                          • Opcode Fuzzy Hash: edfbd52e9ac53efb4a9a6369aa52d07d74c9dcc92654ccaf523fa8f5e4371dfc
                                                                                          • Instruction Fuzzy Hash: 3C519B7190024EBFFF20AF549C808BE7B6AEB42314B24827BF55096271DA399DC5CB19
                                                                                          APIs
                                                                                          • GetStartupInfoA.KERNEL32(?), ref: 0043C501
                                                                                          • GetFileType.KERNEL32(?,?,00000000), ref: 0043C5AC
                                                                                          • GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 0043C60F
                                                                                          • GetFileType.KERNEL32(00000000,?,00000000), ref: 0043C61D
                                                                                          • SetHandleCount.KERNEL32 ref: 0043C654
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandleType$CountInfoStartup
                                                                                          • String ID:
                                                                                          • API String ID: 1710529072-0
                                                                                          • Opcode ID: cd54059ab8396a9d5bd5af99c79488aed7f2acebd1f166b61da730393f30e315
                                                                                          • Instruction ID: 2d2adbbdcf0c6b933dd3f1b750bc6746360afe4e6996f4821519bcb61849f4c3
                                                                                          • Opcode Fuzzy Hash: cd54059ab8396a9d5bd5af99c79488aed7f2acebd1f166b61da730393f30e315
                                                                                          • Instruction Fuzzy Hash: CE51F8715043119BD720CF2CC8C476A77A0AB69324F29667FD492E72E1D738ED06C749
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00432D21
                                                                                          • SendMessageW.USER32(?,00000138,?,?), ref: 00432DBB
                                                                                          • GetBkColor.GDI32(?), ref: 00432DC4
                                                                                          • GetTextColor.GDI32(?), ref: 00432DD0
                                                                                          • GetThreadLocale.KERNEL32(0000F1C0), ref: 00432E5F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Color$H_prologLocaleMessageSendTextThread
                                                                                          • String ID:
                                                                                          • API String ID: 741590120-0
                                                                                          • Opcode ID: 4f1355bbfac436cbf7d85dfa06562748e178381ecde40239ab365eecc8c5cc21
                                                                                          • Instruction ID: c53813d258d8faed882af6d0532bd79093307fbf8e516765aefdc62cac5a73ae
                                                                                          • Opcode Fuzzy Hash: 4f1355bbfac436cbf7d85dfa06562748e178381ecde40239ab365eecc8c5cc21
                                                                                          • Instruction Fuzzy Hash: 19519031400715DFCB20DF55C94259AB7F0FF08311F20991FE8669B7A1E7B8A945CB59
                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32 ref: 00421CFF
                                                                                          • LoadImageW.USER32(00000000), ref: 00421D06
                                                                                          • GetObjectW.GDI32(?,00000018,?), ref: 00421D2A
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 00421D94
                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00421DA3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LongWindow$HandleImageLoadModuleObject
                                                                                          • String ID:
                                                                                          • API String ID: 1749974144-0
                                                                                          • Opcode ID: f48bb330db86a1424ac4596540bd8c1ab9b1d717e2708c3b6651baf6f33b5708
                                                                                          • Instruction ID: 964e3f84d8d9220f239e38bb163473b868f9d66d09f7188b717d3e78b4f9ebd5
                                                                                          • Opcode Fuzzy Hash: f48bb330db86a1424ac4596540bd8c1ab9b1d717e2708c3b6651baf6f33b5708
                                                                                          • Instruction Fuzzy Hash: 264126B0604704AFD354DF2AC844A6BFBE9FB88311F448A2EF586C7391DB75E8448B55
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00448F7E
                                                                                          • GetParent.USER32(?), ref: 00448FBB
                                                                                          • SendMessageW.USER32(?,00000464,00000104,00000000), ref: 00448FE3
                                                                                          • GetParent.USER32(?), ref: 0044900C
                                                                                          • SendMessageW.USER32(?,00000465,00000104,00000000), ref: 00449029
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageParentSend$H_prolog
                                                                                          • String ID:
                                                                                          • API String ID: 1056721960-0
                                                                                          • Opcode ID: 531a387bd93a97027d32abc3864a80f0070cffd68388ab0e20b674dc94eee90e
                                                                                          • Instruction ID: b981bc5619b15a16d5a917a185cbf64e1abb80214b856608b058eb9a631212d7
                                                                                          • Opcode Fuzzy Hash: 531a387bd93a97027d32abc3864a80f0070cffd68388ab0e20b674dc94eee90e
                                                                                          • Instruction Fuzzy Hash: A8315470900219ABEB04EFA6CC55EAFB775FF40318F10452EB521A71D2EB789D05CB58
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bac2b66703288dbdaa283dc63b34984188dde05b1744f0089dc0fe86d1d34517
                                                                                          • Instruction ID: 4725070c96a9f45d7d7068636cb954a9d79d97e24251bc933d38bc642b57d25b
                                                                                          • Opcode Fuzzy Hash: bac2b66703288dbdaa283dc63b34984188dde05b1744f0089dc0fe86d1d34517
                                                                                          • Instruction Fuzzy Hash: 5A319E716006108FE724DF19E88FA1637A1F7A5316F11853BE946C7263C778982ACBDE
                                                                                          APIs
                                                                                          • ClientToScreen.USER32 ref: 00416C48
                                                                                          • ScreenToClient.USER32(?,?), ref: 00416C5A
                                                                                          • PostMessageW.USER32(?,00000450,?,?), ref: 00416CB1
                                                                                          • ReleaseCapture.USER32 ref: 00416CBE
                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00416CCC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClientScreen$CaptureInvalidateMessagePostRectRelease
                                                                                          • String ID:
                                                                                          • API String ID: 134745024-0
                                                                                          • Opcode ID: b0345cbbfb66fbbff7fbbb752c7e432f9bd381a1612d4d561a52ab66f974a7bc
                                                                                          • Instruction ID: f42e24260c0bf5abc69020c01f6de399c74b90aacca186b452680b95f8ecb406
                                                                                          • Opcode Fuzzy Hash: b0345cbbfb66fbbff7fbbb752c7e432f9bd381a1612d4d561a52ab66f974a7bc
                                                                                          • Instruction Fuzzy Hash: 48213875600701AFD718CF69D884A5BB7E6FB88315F10892DF686C7350E630F845CB95
                                                                                          APIs
                                                                                          • GetMapMode.GDI32(?,?,?,?,?,?,004338D2,?,00000000,?,?,?,?,?,?,?), ref: 00452A0D
                                                                                          • GetDeviceCaps.GDI32(?,00000058), ref: 00452A47
                                                                                          • GetDeviceCaps.GDI32(?,0000005A), ref: 00452A50
                                                                                            • Part of subcall function 0045123E: GetWindowExtEx.GDI32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 0045124F
                                                                                            • Part of subcall function 0045123E: GetViewportExtEx.GDI32(?,?,?,?,?,?,?,00000000,00000000), ref: 0045125C
                                                                                            • Part of subcall function 0045123E: MulDiv.KERNEL32(?,00000000,00000000), ref: 00451281
                                                                                            • Part of subcall function 0045123E: MulDiv.KERNEL32(00000002,00000000,00000000), ref: 0045129C
                                                                                          • MulDiv.KERNEL32(?,000009EC,00000060), ref: 00452A74
                                                                                          • MulDiv.KERNEL32(00000002,000009EC,?), ref: 00452A7F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CapsDevice$ModeViewportWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2598972148-0
                                                                                          • Opcode ID: 70eae8aff724d1d0785b587bbedb7da79049ccbc6f895536599558cbe14ae844
                                                                                          • Instruction ID: e1d220746b411d945335c5ab6252b9ffa988d44d39af72ee884f0022c383f944
                                                                                          • Opcode Fuzzy Hash: 70eae8aff724d1d0785b587bbedb7da79049ccbc6f895536599558cbe14ae844
                                                                                          • Instruction Fuzzy Hash: 9C11A032200614AFEB25AF66CC44C2EBBEAEF85711B11042AFD4597362D7B1AD468F54
                                                                                          APIs
                                                                                          • GetMapMode.GDI32(?,00000000,?,?,?,?,00433906,?,?,?,?,?,?,00000000,00000000), ref: 00452A9B
                                                                                          • GetDeviceCaps.GDI32(?,00000058), ref: 00452AD5
                                                                                          • GetDeviceCaps.GDI32(?,0000005A), ref: 00452ADE
                                                                                            • Part of subcall function 004511D5: GetWindowExtEx.GDI32(?,00433906,00000000,?,?,?,00433906,?,?,?,?,?,?,00000000,00000000), ref: 004511E6
                                                                                            • Part of subcall function 004511D5: GetViewportExtEx.GDI32(?,?,?,00433906,?,?,?,?,?,?,00000000,00000000), ref: 004511F3
                                                                                            • Part of subcall function 004511D5: MulDiv.KERNEL32(00433906,00000000,00000000), ref: 00451218
                                                                                            • Part of subcall function 004511D5: MulDiv.KERNEL32(46892C46,00000000,00000000), ref: 00451233
                                                                                          • MulDiv.KERNEL32(00433906,00000060,000009EC), ref: 00452B02
                                                                                          • MulDiv.KERNEL32(46892C46,?,000009EC), ref: 00452B0D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CapsDevice$ModeViewportWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2598972148-0
                                                                                          • Opcode ID: 936009fe5e2268a915083ad7b02151a97078bc735d4568c53e52fdd1029ea609
                                                                                          • Instruction ID: ee88a16ba6b4c95c45bd981e234164788a7b7ecfa8886dbb098ce5e8c8705a83
                                                                                          • Opcode Fuzzy Hash: 936009fe5e2268a915083ad7b02151a97078bc735d4568c53e52fdd1029ea609
                                                                                          • Instruction Fuzzy Hash: E8110231200614AFDB219F26CC44D2EBBA9EF89711B15442BF94197362DBB1ED028B54
                                                                                          APIs
                                                                                          • GetClientRect.USER32(?), ref: 004025C1
                                                                                          • IsWindow.USER32(?), ref: 004025D6
                                                                                          • SendMessageW.USER32(?,00000467,00000000,?), ref: 00402609
                                                                                          • SendMessageW.USER32(?,00000465,00000001,FFFF0000), ref: 00402625
                                                                                          • PlaySoundW.WINMM(?,00000000,00022001), ref: 00402635
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend$ClientPlayRectSoundWindow
                                                                                          • String ID:
                                                                                          • API String ID: 3236464037-0
                                                                                          • Opcode ID: 07c36710fe65a21313f0375c0a6debf982a4f0d4e1635621e8808d3170bf870f
                                                                                          • Instruction ID: 2b4df5a4de0334cb45ceac348ecab1ca02995a1c17d3e5b7767e4095a2d837f9
                                                                                          • Opcode Fuzzy Hash: 07c36710fe65a21313f0375c0a6debf982a4f0d4e1635621e8808d3170bf870f
                                                                                          • Instruction Fuzzy Hash: CC018071200700BBE720DBA5CC89FA7B3A9FB88705F40491DF646D7281EAB5F8048B68
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(?,00000000,0043BE02,00000000,?,?,?,00439195,?,?,00000000,00000000), ref: 0043C6C8
                                                                                          • TlsGetValue.KERNEL32(?,00000000,0043BE02,00000000,?,?,?,00439195,?,?,00000000,00000000), ref: 0043C6D6
                                                                                          • SetLastError.KERNEL32(00000000,?,00000000,0043BE02,00000000,?,?,?,00439195,?,?,00000000,00000000), ref: 0043C722
                                                                                            • Part of subcall function 0044045E: HeapAlloc.KERNEL32(00000008,?,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 004404B3
                                                                                          • TlsSetValue.KERNEL32(00000000,?,00000000,0043BE02,00000000,?,?,?,00439195,?,?,00000000,00000000), ref: 0043C6FA
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0043C70B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLastValue$AllocCurrentHeapThread
                                                                                          • String ID:
                                                                                          • API String ID: 2020098873-0
                                                                                          • Opcode ID: dde71e1e55316553225e7a40cf37a82a7bbb749bc86c83a2bc641a02ca6d594b
                                                                                          • Instruction ID: a7a03b425311ba31b7a7ac1c10e9e06163339a554a63e0d5f6a5191fdd19e9e2
                                                                                          • Opcode Fuzzy Hash: dde71e1e55316553225e7a40cf37a82a7bbb749bc86c83a2bc641a02ca6d594b
                                                                                          • Instruction Fuzzy Hash: 48F02B315007225BD6392B72AC8E65A3B60EF487B2F10063BFD55A6292CF39CD418BD8
                                                                                          APIs
                                                                                          • TlsFree.KERNEL32(00000000,?,?,00454136,00000000,00000001), ref: 00453C35
                                                                                          • GlobalHandle.KERNEL32(007224C8), ref: 00453C5D
                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00453C66
                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00453C6D
                                                                                          • DeleteCriticalSection.KERNEL32(0049850C,?,?,00454136,00000000,00000001), ref: 00453C77
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$Free$CriticalDeleteHandleSectionUnlock
                                                                                          • String ID:
                                                                                          • API String ID: 2159622880-0
                                                                                          • Opcode ID: 029887862207a63af2fb1bf081342d4ecddc8fec2ab8f9d4570ef1c34990d7bb
                                                                                          • Instruction ID: 5b869c3f2272fd1daf00071b1dc63cfc897e77ecb67e143f2a8fac7feae436bb
                                                                                          • Opcode Fuzzy Hash: 029887862207a63af2fb1bf081342d4ecddc8fec2ab8f9d4570ef1c34990d7bb
                                                                                          • Instruction Fuzzy Hash: 4CF0B4322006105BD7295F39AC4CA2B72ECAF95753705055AFC02D3263CB38DE06466C
                                                                                          APIs
                                                                                            • Part of subcall function 0044E5BA: lstrlenA.KERNEL32(?,00000000,?,00000000,0043649B,0000001C), ref: 0044E5CF
                                                                                            • Part of subcall function 0044BC5D: GetWindowTextLengthW.USER32(?), ref: 0044BC6A
                                                                                            • Part of subcall function 0044BC5D: GetWindowTextW.USER32(?,00000000,00000000), ref: 0044BC82
                                                                                          • RedrawWindow.USER32(?,00000000,00000000,00000105,?), ref: 004044A3
                                                                                          • GetParent.USER32(?), ref: 004044AD
                                                                                          • PostMessageW.USER32(?,0000C1E4,00000000,00000000), ref: 004044C8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Text$LengthMessageParentPostRedrawlstrlen
                                                                                          • String ID: 0123456789,.ABCDEF
                                                                                          • API String ID: 2693187184-2448975414
                                                                                          • Opcode ID: c9dc5187e4f1985667e95c11cf01d0f28730d626fbe2c8e7e4d8843bce670407
                                                                                          • Instruction ID: cd7f89cea1dbf5210e511b16d181b64b89ed5aeb13efd4ca4a4f110b8199e763
                                                                                          • Opcode Fuzzy Hash: c9dc5187e4f1985667e95c11cf01d0f28730d626fbe2c8e7e4d8843bce670407
                                                                                          • Instruction Fuzzy Hash: E741B074108341ABD314EF1AC845F6BB7E4BBC8704F004A1EF59593281DB78E909CB6A
                                                                                          APIs
                                                                                          • GetClassNameA.USER32(?,?,00000010), ref: 00446B81
                                                                                          • lstrcmpA.KERNEL32(00465070,?), ref: 00446B9A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClassNamelstrcmp
                                                                                          • String ID: LQF
                                                                                          • API String ID: 3770760073-3135120646
                                                                                          • Opcode ID: 1e681f3837c279ebdc5a918595af1bf69377f971a57a98a72b273a5e790af233
                                                                                          • Instruction ID: 7e8666cea9461e6d799ab0879b2ca254ebad13f69fc63491b08797bfb0edef56
                                                                                          • Opcode Fuzzy Hash: 1e681f3837c279ebdc5a918595af1bf69377f971a57a98a72b273a5e790af233
                                                                                          • Instruction Fuzzy Hash: AE2127726002185FE710AB58EC84DFB335CEA86325F45097BFD15C2221E62BE91982AB
                                                                                          APIs
                                                                                          • GetMenuCheckMarkDimensions.USER32 ref: 00452FE0
                                                                                          • CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 0045308F
                                                                                          • LoadBitmapW.USER32(00000000,00007FE3), ref: 004530A7
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
                                                                                          • String ID:
                                                                                          • API String ID: 2596413745-3916222277
                                                                                          • Opcode ID: dc1391287906921395649542859da5f5f26e402482af1e9c8cbc3e1edb50ebd2
                                                                                          • Instruction ID: 39eab209978b320faefd899ecaa5a522504c79242522ac8a8dcfdf79d86aca0c
                                                                                          • Opcode Fuzzy Hash: dc1391287906921395649542859da5f5f26e402482af1e9c8cbc3e1edb50ebd2
                                                                                          • Instruction Fuzzy Hash: 8D21F572E00315AFDB10CF7CDC85BAE7BB8EB84716F0541A6E905EB2C2D6749B488B54
                                                                                          APIs
                                                                                          • GetPropW.USER32(?,CoolMenu_oldProc), ref: 0042116C
                                                                                          • SetWindowLongW.USER32(?,000000FC,00000000), ref: 0042117E
                                                                                          • RemovePropW.USER32(?,CoolMenu_oldProc), ref: 0042118C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Prop$LongRemoveWindow
                                                                                          • String ID: CoolMenu_oldProc
                                                                                          • API String ID: 885655055-20242104
                                                                                          • Opcode ID: 65f99fd8d606ba011ff638c827fc99d97ac08ac8730a90ff868d22e38a919065
                                                                                          • Instruction ID: 00f5f076dbfdf96b4c6e69964edf8f34c4b275f01d5dbe35613d1e0f4f61a72f
                                                                                          • Opcode Fuzzy Hash: 65f99fd8d606ba011ff638c827fc99d97ac08ac8730a90ff868d22e38a919065
                                                                                          • Instruction Fuzzy Hash: B7214A717001209FC714CF19F88486677A3EBA5364366457BE415D7379E735AC41CB58
                                                                                          APIs
                                                                                          • WideCharToMultiByte.KERNEL32(?,00000220,?,?,?,00000000,00000000,00000000,?,?,?,0043A786,?,00000008,00433235,?), ref: 00442C78
                                                                                          • GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,0043A786,?,00000008,00433235,?), ref: 00442CE3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharMultiStringTypeWide
                                                                                          • String ID: 52C$52C
                                                                                          • API String ID: 3139900361-1048808189
                                                                                          • Opcode ID: 88623260d600502feea11b892452cf824f246833c2f7e6518612f765ac111f8d
                                                                                          • Instruction ID: bd4a2f300cf736bad574bc5578329f1010aa73e467dca70cbb09e908a85f2bfb
                                                                                          • Opcode Fuzzy Hash: 88623260d600502feea11b892452cf824f246833c2f7e6518612f765ac111f8d
                                                                                          • Instruction Fuzzy Hash: 95219A71C0020AEFDF20CF98E8458DEBBB1FF48314F20851AF561A32A0D3B59951CBA4
                                                                                          APIs
                                                                                          • GetModuleHandleW.KERNEL32(00000000,?,00000000,00000000,00000000,00002010,?,?,?), ref: 004026D6
                                                                                          • LoadImageW.USER32(00000000), ref: 004026DD
                                                                                          Strings
                                                                                          • C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\, xrefs: 00402689
                                                                                          • skins\double_click.bmp, xrefs: 00402697
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: HandleImageLoadModule
                                                                                          • String ID: C:\Users\user\AppData\Roaming\MOUSE DRIVER V628M\$skins\double_click.bmp
                                                                                          • API String ID: 2603579926-3061676111
                                                                                          • Opcode ID: 5d332cefeac7710fc1ecbb6b8bd49fd9f5ac5b2c6957a978a62e824fe991e250
                                                                                          • Instruction ID: ae4c81d04c37cac6c942fe535b3c6e4faf3bb4221cf6aad66b2c9ee9df5dcde4
                                                                                          • Opcode Fuzzy Hash: 5d332cefeac7710fc1ecbb6b8bd49fd9f5ac5b2c6957a978a62e824fe991e250
                                                                                          • Instruction Fuzzy Hash: AF21A271148741AFE310EF65C846F5AB7E4FB54B24F008E2EF499822D2DB78A108CB5A
                                                                                          APIs
                                                                                          • PtInRect.USER32(?,?,?), ref: 004154BC
                                                                                          • PostMessageW.USER32(?,0000046A,00000000,00000000), ref: 004154E6
                                                                                          • wsprintfW.USER32 ref: 004154FA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessagePostRectwsprintf
                                                                                          • String ID: Select Color:=%d
                                                                                          • API String ID: 2817272175-3560948424
                                                                                          • Opcode ID: 6bf9a5f632b3bd98bc50207aea8a4879e12057076b6f120c5ca570fc2faeee06
                                                                                          • Instruction ID: 5bc4efbde4e69b771a6edbe673061e44b9bc85ec2b03b6c71149f240d1d9c6b5
                                                                                          • Opcode Fuzzy Hash: 6bf9a5f632b3bd98bc50207aea8a4879e12057076b6f120c5ca570fc2faeee06
                                                                                          • Instruction Fuzzy Hash: 1001B531200314ABE714AB59DC84FAB7728EB84716F00453EFD0587282E6749945CB69
                                                                                          APIs
                                                                                          • InterlockedIncrement.KERNEL32(00499F60), ref: 00442743
                                                                                          • InterlockedDecrement.KERNEL32(00499F60), ref: 0044275A
                                                                                            • Part of subcall function 0043D7A4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00440494,00000009,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 0043D7E1
                                                                                            • Part of subcall function 0043D7A4: EnterCriticalSection.KERNEL32(?,?,?,00440494,00000009,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 0043D7FC
                                                                                          • InterlockedDecrement.KERNEL32(00499F60), ref: 00442786
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
                                                                                          • String ID: _C
                                                                                          • API String ID: 2038102319-2193721243
                                                                                          • Opcode ID: 0d4bda9222d676b7e733f11c3407a82576394c0b3171b0335325e7fb855fc108
                                                                                          • Instruction ID: 0100cb02a4e95248c1f680bd8e47fea0a60c568afcb84f5ac6e25bae4e289eb1
                                                                                          • Opcode Fuzzy Hash: 0d4bda9222d676b7e733f11c3407a82576394c0b3171b0335325e7fb855fc108
                                                                                          • Instruction Fuzzy Hash: 43F0BE36101219BFEB003B56BC81A9A775CDF98375F10403FF508891418BB99A028A6D
                                                                                          APIs
                                                                                          • wsprintfW.USER32 ref: 00408F33
                                                                                          • OutputDebugStringW.KERNEL32(?), ref: 00408F41
                                                                                          • PostMessageW.USER32(00000000,0000040A,?,?), ref: 00408F5F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DebugMessageOutputPostStringwsprintf
                                                                                          • String ID: %x
                                                                                          • API String ID: 2045784622-3337897977
                                                                                          • Opcode ID: 61a54ee4e5a1549a008524f3eb226df504cd5ce472d6eec33019027297c53a99
                                                                                          • Instruction ID: d25185f4ec19fdadee884083aefa66d6b920810ac2cf64789db054c90baef9e8
                                                                                          • Opcode Fuzzy Hash: 61a54ee4e5a1549a008524f3eb226df504cd5ce472d6eec33019027297c53a99
                                                                                          • Instruction Fuzzy Hash: F9F09075100300ABE320DB18DD89F6B73A8AB98701F00852DB89593291EA79E954CB99
                                                                                          APIs
                                                                                          • GdipCloneBrush.GDIPLUS(00000000,?), ref: 00403CF5
                                                                                          • GdipAlloc.GDIPLUS(0000000C,00000000,?), ref: 00403D03
                                                                                          • GdipDeleteBrush.GDIPLUS(00000000,0000000C,00000000,?), ref: 00403D29
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Gdip$Brush$AllocCloneDelete
                                                                                          • String ID: `=@
                                                                                          • API String ID: 1454917728-2879527708
                                                                                          • Opcode ID: 91ba35451fefcffae4fcddc6c6fde3a9dd7cf726c3f5f460098dd66b67c6cf2a
                                                                                          • Instruction ID: 150e992bc9662c65c0bcd822f01aff9662840a073a2f11320dd45842b71d4e34
                                                                                          • Opcode Fuzzy Hash: 91ba35451fefcffae4fcddc6c6fde3a9dd7cf726c3f5f460098dd66b67c6cf2a
                                                                                          • Instruction Fuzzy Hash: EFF034B5200310AAE724DB61D941A67BBE8EF84B11F15886FE94A8B681DB74EC00DB94
                                                                                          APIs
                                                                                          • SetWindowsHookExW.USER32(0000000D,Function_00008F10,?,00000000), ref: 00408FBF
                                                                                          • wsprintfW.USER32 ref: 00408FD5
                                                                                          • OutputDebugStringW.KERNEL32(00000000), ref: 00408FE3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: DebugHookOutputStringWindowswsprintf
                                                                                          • String ID: Hhook: %x
                                                                                          • API String ID: 3801522495-986256327
                                                                                          • Opcode ID: 83410e80fb08f7843c1303500ac871c7abdd9a535c01efad9fad950c31c1a0ff
                                                                                          • Instruction ID: f5ea10c5fb00cbc413acfb87eff599662169e5acb2f1118bcb6b143fec94697c
                                                                                          • Opcode Fuzzy Hash: 83410e80fb08f7843c1303500ac871c7abdd9a535c01efad9fad950c31c1a0ff
                                                                                          • Instruction Fuzzy Hash: E8F08C70541301BBD328DFA4EC09B263BA4BB88315F06483EA905C62AAFB78D504CB4D
                                                                                          APIs
                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 00451C60
                                                                                          • GetClassNameW.USER32(00000000,?,0000000A), ref: 00451C7B
                                                                                          • lstrcmpiW.KERNEL32(?,combobox), ref: 00451C8A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClassLongNameWindowlstrcmpi
                                                                                          • String ID: combobox
                                                                                          • API String ID: 2054663530-2240613097
                                                                                          • Opcode ID: 0833c0ada7cba2a358d1ea47ca814718905475fa76bd1e284d21763af1981cd3
                                                                                          • Instruction ID: 8b2bd49c5c12006dd92be3201ba39ab5e6120f5dd730b60f84b236382d5c1acf
                                                                                          • Opcode Fuzzy Hash: 0833c0ada7cba2a358d1ea47ca814718905475fa76bd1e284d21763af1981cd3
                                                                                          • Instruction Fuzzy Hash: 50E0303155420DBBCB019FA4CD49B6A37A8AB01306F104522F813D51A2D675E645966A
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(KERNEL32,00439740), ref: 0043D331
                                                                                          • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0043D341
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                          • API String ID: 1646373207-3105848591
                                                                                          • Opcode ID: d0b27036ece79291afb6a5be5f25382392fa7035d8db25a5049aafaa5cfb86dc
                                                                                          • Instruction ID: 34049335ab8aae69742e613de0eee6d2de5889985e5d6be3ed294cd51dbc911e
                                                                                          • Opcode Fuzzy Hash: d0b27036ece79291afb6a5be5f25382392fa7035d8db25a5049aafaa5cfb86dc
                                                                                          • Instruction Fuzzy Hash: B0C08C70B803027BDE201BB22C09B1B220C2B88B43F1818A2BE06E00D4EE5DCA00C82F
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 0043561A
                                                                                          • VariantClear.OLEAUT32(?), ref: 004356CC
                                                                                          • CoTaskMemFree.OLE32(?,?,?,00000000), ref: 00435769
                                                                                          • CoTaskMemFree.OLE32(?,?,?,00000000), ref: 00435777
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FreeTask$ClearH_prologVariant
                                                                                          • String ID:
                                                                                          • API String ID: 82050969-0
                                                                                          • Opcode ID: d210579a598727ab6b3fbfd077bbbcb990cc785d0f8ecf0111826dd595085a98
                                                                                          • Instruction ID: dfa254004b77155f908dcfb3bc581db27327518a51c018259e73b431d53c73bd
                                                                                          • Opcode Fuzzy Hash: d210579a598727ab6b3fbfd077bbbcb990cc785d0f8ecf0111826dd595085a98
                                                                                          • Instruction Fuzzy Hash: 8C616931600A01CFCB20DFA5C9C596AB3F6BF48308B54596EE14ADBB61CB38EC41CB54
                                                                                          APIs
                                                                                          • ReadFile.KERNEL32(?,?,00000000,?,00000000,?,?,00439D8A), ref: 004408CE
                                                                                          • GetLastError.KERNEL32 ref: 004408D8
                                                                                          • ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 0044099E
                                                                                          • GetLastError.KERNEL32 ref: 004409A8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileLastRead
                                                                                          • String ID:
                                                                                          • API String ID: 1948546556-0
                                                                                          • Opcode ID: 555547b4457f28537e7cbe0d16de8f99b3c7e028aab8236c97092273228f5c60
                                                                                          • Instruction ID: 98a2c44f2fa039e134df7cac227884288eeb95ee15f100cb5aeeaa48c6e359a9
                                                                                          • Opcode Fuzzy Hash: 555547b4457f28537e7cbe0d16de8f99b3c7e028aab8236c97092273228f5c60
                                                                                          • Instruction Fuzzy Hash: 4751F8706043899FFF218F58C8807AA7BB0BF16304F14459BEA919B353C378D966CB1A
                                                                                          APIs
                                                                                          • IsWindowVisible.USER32(?), ref: 0043596E
                                                                                          • GetDesktopWindow.USER32 ref: 00435981
                                                                                          • GetWindowRect.USER32(?,?), ref: 00435994
                                                                                          • GetWindowRect.USER32(?,?), ref: 004359A1
                                                                                            • Part of subcall function 0044DB8F: MoveWindow.USER32(?,?,?,00000000,?,?,?,00435AE2,?,?,?,?,00000000), ref: 0044DBAB
                                                                                            • Part of subcall function 0044DC1F: ShowWindow.USER32(?,?,00435AEB,00000000,?,?,?,?,00000000), ref: 0044DC2D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Rect$DesktopMoveShowVisible
                                                                                          • String ID:
                                                                                          • API String ID: 3835705305-0
                                                                                          • Opcode ID: c44c3f014d2d7acb3898cad435ba21f06f752bc5055732a931a87cfbc1288509
                                                                                          • Instruction ID: 7abe2873a1c80c0baf8200eb9af45bab6c570942bb81fa46566f25d03840bafe
                                                                                          • Opcode Fuzzy Hash: c44c3f014d2d7acb3898cad435ba21f06f752bc5055732a931a87cfbc1288509
                                                                                          • Instruction Fuzzy Hash: 69512871A0050AAFCF04EFA9C985DAEB7B9FF48305B20455AF206EB250DB35AD01DB65
                                                                                          APIs
                                                                                          • WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 00440B59
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3934441357-0
                                                                                          • Opcode ID: 28fb70542d96e7e0b288c058e7ca664fbb8fc8a93e964950252c7d169ff4bad3
                                                                                          • Instruction ID: a9fab567a957e13453fa4b731ce75d9916ad6de1eaacd361dfd1ab53d885ef31
                                                                                          • Opcode Fuzzy Hash: 28fb70542d96e7e0b288c058e7ca664fbb8fc8a93e964950252c7d169ff4bad3
                                                                                          • Instruction Fuzzy Hash: 3051D13090024CEFEB11CFA8C884A9E7BB4FF45344F2481ABFA559B251D734EA60DB59
                                                                                          APIs
                                                                                          • GetPropA.USER32(?,?), ref: 00447C66
                                                                                          • CallWindowProcA.USER32(00000000), ref: 00447C91
                                                                                            • Part of subcall function 004451A0: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 004451C6
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451DE
                                                                                            • Part of subcall function 004451A0: RemovePropA.USER32(?,?), ref: 004451EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Prop$CallProcRemoveWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2276450057-0
                                                                                          • Opcode ID: 1dc0820facbb71b29bdc4e0a4067084ce676db6a54b413d5adb20655e3bce2fc
                                                                                          • Instruction ID: 900526cd8fcb153e1456e09c8f668876fa39ff23710167bdf53c75ce517ea33a
                                                                                          • Opcode Fuzzy Hash: 1dc0820facbb71b29bdc4e0a4067084ce676db6a54b413d5adb20655e3bce2fc
                                                                                          • Instruction Fuzzy Hash: DB31F876B082045BF6109A19FCC5AAF7398FB86339F540537F90593201D72DAE5B82AF
                                                                                          APIs
                                                                                          • GetClientRect.USER32(?,?), ref: 00422C7F
                                                                                            • Part of subcall function 00451199: ClientToScreen.USER32(?,?), ref: 004511AD
                                                                                            • Part of subcall function 00451199: ClientToScreen.USER32(?,?), ref: 004511B6
                                                                                            • Part of subcall function 0045115D: ScreenToClient.USER32(?,00421E62), ref: 00451171
                                                                                            • Part of subcall function 0045115D: ScreenToClient.USER32(?,00421E6A), ref: 0045117A
                                                                                          • ClientToScreen.USER32(?,?), ref: 00422D03
                                                                                          • ScreenToClient.USER32(?,?), ref: 00422D15
                                                                                          • PostMessageW.USER32(?,00000446,?,?), ref: 00422D88
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Client$Screen$MessagePostRect
                                                                                          • String ID:
                                                                                          • API String ID: 2649781343-0
                                                                                          • Opcode ID: 836f5a3ebab0be1dd712540b6d2b0ea66c92962cf1f7ef8f7d80fbe8ed233326
                                                                                          • Instruction ID: 18e84b310e865657d61a0f73dbfed8c11970ba836a3ee5f30ad7d1bc56325dbf
                                                                                          • Opcode Fuzzy Hash: 836f5a3ebab0be1dd712540b6d2b0ea66c92962cf1f7ef8f7d80fbe8ed233326
                                                                                          • Instruction Fuzzy Hash: 32414B71304B069FC718CF29D98496BB7E6BB88304B408A2DF596C3765EA70F9058B55
                                                                                          APIs
                                                                                            • Part of subcall function 0045140F: __EH_prolog.LIBCMT ref: 00451414
                                                                                            • Part of subcall function 0045140F: BeginPaint.USER32(?,?,?,?,00401097), ref: 0045143D
                                                                                          • GetClientRect.USER32 ref: 00402793
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004027B6
                                                                                          • GetObjectW.GDI32(?,00000018,?), ref: 00402802
                                                                                          • StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0040283E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: BeginClientCompatibleCreateH_prologObjectPaintRectStretch
                                                                                          • String ID:
                                                                                          • API String ID: 389850046-0
                                                                                          • Opcode ID: 3b9c0a8d391189c971949dbac668611dfbdc6557188e0c095ad09b845efc8160
                                                                                          • Instruction ID: b31d11f639d862a3d4212195989c4b78ef14485881b5d5ab88f897462bc8c2e7
                                                                                          • Opcode Fuzzy Hash: 3b9c0a8d391189c971949dbac668611dfbdc6557188e0c095ad09b845efc8160
                                                                                          • Instruction Fuzzy Hash: AA41B276208341AFC314DF65C984F5BB7E8FB98705F004A2DF94997282DB78E909CB66
                                                                                          APIs
                                                                                          • LoadBitmapW.USER32(?,?), ref: 0042265F
                                                                                          • GetObjectW.GDI32(?,00000018,?), ref: 0042268A
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 004226F4
                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00422703
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: LongWindow$BitmapLoadObject
                                                                                          • String ID:
                                                                                          • API String ID: 2047396803-0
                                                                                          • Opcode ID: 184168417041223889e115baa9ad7639a732af88177faa780ca05404cf89966d
                                                                                          • Instruction ID: be54d8ce911b4556c4449e4dbec1ac8c6a2b83e514d9e13aef438db091430c70
                                                                                          • Opcode Fuzzy Hash: 184168417041223889e115baa9ad7639a732af88177faa780ca05404cf89966d
                                                                                          • Instruction Fuzzy Hash: 294127B5604700AFD354DF29C880A6BFBE5FBC8311F448A2EF986C7351DA75E8048B55
                                                                                          APIs
                                                                                            • Part of subcall function 0043D7A4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00440494,00000009,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 0043D7E1
                                                                                            • Part of subcall function 0043D7A4: EnterCriticalSection.KERNEL32(?,?,?,00440494,00000009,?,?,?,0043C67E,00000001,00000074,?,0043910C), ref: 0043D7FC
                                                                                          • InitializeCriticalSection.KERNEL32(00000080,?,?,?,00000000,?,?,0043AB8C), ref: 0043A92A
                                                                                          • EnterCriticalSection.KERNEL32(00000080,?,?,?,00000000,?,?,0043AB8C), ref: 0043A93F
                                                                                          • LeaveCriticalSection.KERNEL32(00000080,?,?,?,00000000,?,?,0043AB8C), ref: 0043A94C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$EnterInitialize$Leave
                                                                                          • String ID:
                                                                                          • API String ID: 713024617-3916222277
                                                                                          • Opcode ID: 121ff04cd3fe376fa21fcaf7fee4b23d5326c8e1992f8e94500b00e7b51e5660
                                                                                          • Instruction ID: ee21a2378e54ee6ce4b2bdb7b0640a970c94e1ac1404fb8fb2f1653d11f61612
                                                                                          • Opcode Fuzzy Hash: 121ff04cd3fe376fa21fcaf7fee4b23d5326c8e1992f8e94500b00e7b51e5660
                                                                                          • Instruction Fuzzy Hash: 5E3177B25403008FD314DF25EC85B5AB7E0EF48328F259E2FE5A2572D2C778E844875A
                                                                                          APIs
                                                                                            • Part of subcall function 004521E6: GetParent.USER32(?), ref: 00452219
                                                                                            • Part of subcall function 004521E6: GetLastActivePopup.USER32(?), ref: 00452228
                                                                                            • Part of subcall function 004521E6: IsWindowEnabled.USER32(?), ref: 0045223D
                                                                                            • Part of subcall function 004521E6: EnableWindow.USER32(?,00000000), ref: 00452250
                                                                                          • SendMessageW.USER32(?,00000376,00000000,00000000), ref: 004520A4
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00452112
                                                                                          • MessageBoxW.USER32(00000000,?,?,00000000), ref: 00452120
                                                                                          • EnableWindow.USER32(00000000,00000001), ref: 0045213C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
                                                                                          • String ID:
                                                                                          • API String ID: 1958756768-0
                                                                                          • Opcode ID: ad5b4c8d15ced494c1dcbc734ffd644a0e0c61981cda24845ac2886f9a6ec37a
                                                                                          • Instruction ID: bdcf592056cd98dd43b2a08c2b3f151254dad3e1f338fbbd645d3d94b3ffe6f5
                                                                                          • Opcode Fuzzy Hash: ad5b4c8d15ced494c1dcbc734ffd644a0e0c61981cda24845ac2886f9a6ec37a
                                                                                          • Instruction Fuzzy Hash: B421C332901208AFDB209F95CDC5AAFB7B5FB05712F14442BEA00E3292D7B98D48CB95
                                                                                          APIs
                                                                                          • lstrcpynW.KERNEL32(004506A3,?,00000104,?,?,?,?,?,?,?,00450691,?), ref: 004506D1
                                                                                          • GetFileTime.KERNEL32(00000000,00450691,?,?,?,?,?,?,?,?,?,00450691,?), ref: 004506F2
                                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00450691,?), ref: 00450701
                                                                                          • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00450691,?), ref: 00450722
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$AttributesSizeTimelstrcpyn
                                                                                          • String ID:
                                                                                          • API String ID: 1499663573-0
                                                                                          • Opcode ID: 06c4ca5061588e9a84b2cc068c118407428790aa45585a6ecf1ba106f165ec73
                                                                                          • Instruction ID: c1e5c88729c0d4156ad560fd7226e1374fff623326021382f4b7a4989042b988
                                                                                          • Opcode Fuzzy Hash: 06c4ca5061588e9a84b2cc068c118407428790aa45585a6ecf1ba106f165ec73
                                                                                          • Instruction Fuzzy Hash: 11319C76500605AFDB10DFA1CC85EABB7A8BB18341F104A2AF552C7292E774F989CF94
                                                                                          APIs
                                                                                          • GetClientRect.USER32 ref: 0042CBCC
                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0042CBFC
                                                                                          • OffsetRect.USER32(?,?,00000000), ref: 0042CC2B
                                                                                          • GetWindow.USER32(?,00000005), ref: 0042CC5C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: RectWindow$ClientLongOffset
                                                                                          • String ID:
                                                                                          • API String ID: 2181703649-0
                                                                                          • Opcode ID: 5d00002748e77b82c6ad415b6cdb338eb6ca91bdde9e05cdda2cc5061e0c4865
                                                                                          • Instruction ID: de08a2dad802c3085342e8370fc28d5bf423d19968f497ed06c37d988cbe2028
                                                                                          • Opcode Fuzzy Hash: 5d00002748e77b82c6ad415b6cdb338eb6ca91bdde9e05cdda2cc5061e0c4865
                                                                                          • Instruction Fuzzy Hash: 60214B71244704AFE320DF66DC84F6BB7E8FB88704F00491EF99997290E674E9058B95
                                                                                          APIs
                                                                                          • SetCapture.USER32(?), ref: 0042BE3A
                                                                                          • GetParent.USER32(?), ref: 0042BE97
                                                                                          • SendMessageW.USER32(?,-00000114,?,?), ref: 0042BED2
                                                                                          • SetTimer.USER32(?,000000C8,000001F4,00000000), ref: 0042BEE8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CaptureMessageParentSendTimer
                                                                                          • String ID:
                                                                                          • API String ID: 1837449964-0
                                                                                          • Opcode ID: 81afbd07bead6b6bb80095e39d58c5655a9d5fab3b0499241646ff0830bd0502
                                                                                          • Instruction ID: 873fa895f725b4d1e7e357525f5f22c3ec05e107cdc86373b0220da2ecb74ed8
                                                                                          • Opcode Fuzzy Hash: 81afbd07bead6b6bb80095e39d58c5655a9d5fab3b0499241646ff0830bd0502
                                                                                          • Instruction Fuzzy Hash: 792180713007149FD3209F76D885FABB7E8EF85705F00891EF95AC3251DB75A8058BA4
                                                                                          APIs
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,00000000,?,?,?), ref: 00444614
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00444627
                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 00444673
                                                                                          • CompareStringW.KERNEL32(?,?,?,?,?,00000000,?,00000000), ref: 0044468B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharMultiWide$CompareString
                                                                                          • String ID:
                                                                                          • API String ID: 376665442-0
                                                                                          • Opcode ID: 4920b26e1768d24b0d1f413d7949c87ff64cf410c0cdc01aa30786b5b457ddbb
                                                                                          • Instruction ID: cf074cf3db192aa20fbb5ef26ce2db9755d9b81669fded12983ef16fc11340aa
                                                                                          • Opcode Fuzzy Hash: 4920b26e1768d24b0d1f413d7949c87ff64cf410c0cdc01aa30786b5b457ddbb
                                                                                          • Instruction Fuzzy Hash: 39213B32900209EBDF218FD5DC41ADEBFB5FF89350F11416AFA1472160C77A9A61DB94
                                                                                          APIs
                                                                                          • GetPropA.USER32(?,?), ref: 00445A7D
                                                                                          • SendMessageA.USER32(?,00001944,00000000,?), ref: 00445AA2
                                                                                          • SendMessageA.USER32(?,00001943,00000000,?), ref: 00445AB7
                                                                                          • RemovePropA.USER32(?,?), ref: 00445ACD
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessagePropSend$Remove
                                                                                          • String ID:
                                                                                          • API String ID: 2793251306-0
                                                                                          • Opcode ID: 48518776f887a608f25053aef12f92551a5623445340afb24abca19881e9c760
                                                                                          • Instruction ID: b2676de077e66ae679f529101ccaed7540dd868afc407b2e4e36a30edbe630ec
                                                                                          • Opcode Fuzzy Hash: 48518776f887a608f25053aef12f92551a5623445340afb24abca19881e9c760
                                                                                          • Instruction Fuzzy Hash: 5F1173796407106FF600AB11AC45FAB7398EB95769F00443AFD1492241E278A90A8BBF
                                                                                          APIs
                                                                                          • __EH_prolog.LIBCMT ref: 00454BD7
                                                                                          • FormatMessageW.KERNEL32(00001100,00000000,?,00000800,00000000,00000000,00000000,?,?,0046E8A8,00000000,?,00455F83,00000000), ref: 00454C47
                                                                                          • lstrcpynW.KERNEL32(00455F83,00000000,?,?,0046E8A8,00000000,?,00455F83,00000000,?,?,?,?,00000000), ref: 00454C64
                                                                                          • LocalFree.KERNEL32(00000000,?,0046E8A8,00000000,?,00455F83,00000000,?,?,?,?,00000000), ref: 00454C6D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FormatFreeH_prologLocalMessagelstrcpyn
                                                                                          • String ID:
                                                                                          • API String ID: 1069405352-0
                                                                                          • Opcode ID: a0c2492dc20814bc7844d032ca7ceb33d6922cbc5d6b62f423373c934c95c03a
                                                                                          • Instruction ID: ea32257133c76dcbbb2bf915e75af863220a1aa170d55ad383c45c95aa045de3
                                                                                          • Opcode Fuzzy Hash: a0c2492dc20814bc7844d032ca7ceb33d6922cbc5d6b62f423373c934c95c03a
                                                                                          • Instruction Fuzzy Hash: 2211D072501328BBDB219F95CC05ADF7BA8FF08762F10801AF9198A191D3B49A41CBD9
                                                                                          APIs
                                                                                          • GetWindow.USER32(?,00000005), ref: 00445B13
                                                                                          • GetWindow.USER32(00000000,00000005), ref: 00445B2F
                                                                                          • GetWindow.USER32(00000000,00000002), ref: 00445B45
                                                                                          • GetWindow.USER32(00000000,00000002), ref: 00445B50
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window
                                                                                          • String ID:
                                                                                          • API String ID: 2353593579-0
                                                                                          • Opcode ID: 1a9cc3f8b1c2a9540404fa9cf884f296ae65365bbc6bbf7084d48adacbf5d9c5
                                                                                          • Instruction ID: c4837880523f6938e34e571c6e5e080d3f470a00b783952d05e2a399cf36c6c8
                                                                                          • Opcode Fuzzy Hash: 1a9cc3f8b1c2a9540404fa9cf884f296ae65365bbc6bbf7084d48adacbf5d9c5
                                                                                          • Instruction Fuzzy Hash: 72F0F423300B4523E62165AA2CCAF2BB798CBE2B51F50003BF200A6283FD59E8158269
                                                                                          APIs
                                                                                          • CallNextHookEx.USER32(00000000,?,?,?), ref: 004450CB
                                                                                          • UnhookWindowsHookEx.USER32(00000000), ref: 004450E4
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 004450FB
                                                                                          • SendMessageA.USER32(00000001,000011F0,00000000,00000001), ref: 00445125
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Hook$CallLongMessageNextSendUnhookWindowWindows
                                                                                          • String ID:
                                                                                          • API String ID: 4187046592-0
                                                                                          • Opcode ID: 40de02bef67aed5e25722528e7b48f6e9f86b9e5a327ec2661da1ea3d64006a0
                                                                                          • Instruction ID: 6d1e683d501d50ab907639d652a3b00d735eb3ede67984bd1a553b0dd09ed427
                                                                                          • Opcode Fuzzy Hash: 40de02bef67aed5e25722528e7b48f6e9f86b9e5a327ec2661da1ea3d64006a0
                                                                                          • Instruction Fuzzy Hash: 9B114975500301AFE704CF28EC48E5777E8AB99315F00843EF956C3262DB34E844CB69
                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00445596
                                                                                          • EnterCriticalSection.KERNEL32(0049A0A0), ref: 004455A3
                                                                                          • UnhookWindowsHookEx.USER32(?), ref: 004455E6
                                                                                          • LeaveCriticalSection.KERNEL32(0049A0A0), ref: 0044562B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$CurrentEnterHookLeaveThreadUnhookWindows
                                                                                          • String ID:
                                                                                          • API String ID: 1197249173-0
                                                                                          • Opcode ID: fcec4f3e13c00353979007dce3ca7f306dc833ba632c63f0542c03eada54cf20
                                                                                          • Instruction ID: 793e3851ec76fff83c2c56f34c8a2a50fa1d68917ab4b677b1f9feef90de27b3
                                                                                          • Opcode Fuzzy Hash: fcec4f3e13c00353979007dce3ca7f306dc833ba632c63f0542c03eada54cf20
                                                                                          • Instruction Fuzzy Hash: E8119131100A089FDB10AF65E88AA2673A5F75530AF81047BE54A83162D739ED35CF9E
                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 0044F7D3
                                                                                          • GetCurrentProcess.KERNEL32(?,00000000), ref: 0044F7D9
                                                                                          • DuplicateHandle.KERNEL32(00000000), ref: 0044F7DC
                                                                                          • GetLastError.KERNEL32(00000000), ref: 0044F7F6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentProcess$DuplicateErrorHandleLast
                                                                                          • String ID:
                                                                                          • API String ID: 3907606552-0
                                                                                          • Opcode ID: 15fcddd9fa386e299d6e894e4d1f3077f2e765fcf32a458132e6928abd2c05c7
                                                                                          • Instruction ID: 369bcbe896e4aa04b2d9874db2c01723b43853554e28dc7bf4f58362fbe3f1de
                                                                                          • Opcode Fuzzy Hash: 15fcddd9fa386e299d6e894e4d1f3077f2e765fcf32a458132e6928abd2c05c7
                                                                                          • Instruction Fuzzy Hash: 590184757002007BEB109BAACD4AF5A7B9CEF84721F144477F905CB281EAB8ED008765
                                                                                          APIs
                                                                                          • GetWindowRect.USER32(?,00000000), ref: 0042180D
                                                                                          • OffsetRect.USER32(?,?,?), ref: 00421826
                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 0042184F
                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00421870
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Rect$Inflate$OffsetWindow
                                                                                          • String ID:
                                                                                          • API String ID: 3865976591-0
                                                                                          • Opcode ID: e6e4d3b04612696ff37293890f826e23375223251ac7cfb5b94a67505f0205f2
                                                                                          • Instruction ID: 17184576829408a94ec026a39318fc63f54ab4e171015bf1ecbfa0e1872e1e4b
                                                                                          • Opcode Fuzzy Hash: e6e4d3b04612696ff37293890f826e23375223251ac7cfb5b94a67505f0205f2
                                                                                          • Instruction Fuzzy Hash: 02016D752083107FC604EB59CC42D6F73A8ABC9731F50CB4DF679922D1DA70A5088656
                                                                                          APIs
                                                                                          • WindowFromPoint.USER32(?,?), ref: 00449923
                                                                                          • GetParent.USER32(00000000), ref: 00449930
                                                                                          • ScreenToClient.USER32(00000000,?), ref: 00449951
                                                                                          • IsWindowEnabled.USER32(00000000), ref: 0044996A
                                                                                            • Part of subcall function 00451C4F: GetWindowLongW.USER32(00000000,000000F0), ref: 00451C60
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ClientEnabledFromLongParentPointScreen
                                                                                          • String ID:
                                                                                          • API String ID: 2204725058-0
                                                                                          • Opcode ID: 30f89d2e99fc6264cf1c93003c79a8d842d9f8d917d053aeddcc4b69dcb5bc3d
                                                                                          • Instruction ID: 8691219640cc313b608e0cfb5473a721630fd0f222a7c7c738e35ffd7154531f
                                                                                          • Opcode Fuzzy Hash: 30f89d2e99fc6264cf1c93003c79a8d842d9f8d917d053aeddcc4b69dcb5bc3d
                                                                                          • Instruction Fuzzy Hash: 0301D476600604BF97069B9A8C04DEFBAB9AF8975570441AEF905D3321FB34CE00D759
                                                                                          APIs
                                                                                          • GetDlgItem.USER32(?,?), ref: 0044C8EB
                                                                                          • GetTopWindow.USER32(00000000), ref: 0044C8FE
                                                                                          • GetTopWindow.USER32(?), ref: 0044C92E
                                                                                          • GetWindow.USER32(00000000,00000002), ref: 0044C949
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Item
                                                                                          • String ID:
                                                                                          • API String ID: 369458955-0
                                                                                          • Opcode ID: 914f32601eed88ce2016b49421a79a873c6c27faf33f3aa1588b07b812734f2a
                                                                                          • Instruction ID: f317c4f1fe85914620878e9fe11b86928236ba3fdd79d61cad4b3cc0478370ce
                                                                                          • Opcode Fuzzy Hash: 914f32601eed88ce2016b49421a79a873c6c27faf33f3aa1588b07b812734f2a
                                                                                          • Instruction Fuzzy Hash: F2014F73103616B7BF622F629C41AAF7B58AF45795F088427FE00D1221D739CA12A6ED
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Item$EnableFocusMenuNextParent
                                                                                          • String ID:
                                                                                          • API String ID: 988757621-0
                                                                                          • Opcode ID: 1827bff489e50de75984ce15d880868b5a2712d746b45bb48d012cf34ed1b18d
                                                                                          • Instruction ID: 9952474f10214a916127cce15c76578d68a72f0a1035517db0517edf8a2b111f
                                                                                          • Opcode Fuzzy Hash: 1827bff489e50de75984ce15d880868b5a2712d746b45bb48d012cf34ed1b18d
                                                                                          • Instruction Fuzzy Hash: 4A115E31100A109BEB389F26EC59B2BB7B5FF50315F108A2EF152865A1C7B9E855CB58
                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004457D6
                                                                                          • EnterCriticalSection.KERNEL32(0049A0A0), ref: 004457E3
                                                                                          • UnhookWindowsHookEx.USER32(?), ref: 0044581A
                                                                                          • LeaveCriticalSection.KERNEL32(0049A0A0), ref: 00445859
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$CurrentEnterHookLeaveThreadUnhookWindows
                                                                                          • String ID:
                                                                                          • API String ID: 1197249173-0
                                                                                          • Opcode ID: 877a6f65bcce4066a8e2e446f829590c72e09da3bf7943897164b284acbe86b9
                                                                                          • Instruction ID: 5c920a2f50e906e6fadc30b4abbb1875b43ee98e5f15a1e67a8b1402caedcaea
                                                                                          • Opcode Fuzzy Hash: 877a6f65bcce4066a8e2e446f829590c72e09da3bf7943897164b284acbe86b9
                                                                                          • Instruction Fuzzy Hash: 03017931100A089FDB10AF65E8CBA6637A4F756306F40047BE95687123EB35A935CF9D
                                                                                          APIs
                                                                                          • RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 004522BA
                                                                                          • RegCloseKey.ADVAPI32(00000000,?,?), ref: 004522C3
                                                                                          • wsprintfW.USER32 ref: 004522DF
                                                                                          • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 004522F8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClosePrivateProfileStringValueWritewsprintf
                                                                                          • String ID:
                                                                                          • API String ID: 1902064621-0
                                                                                          • Opcode ID: 9a28ede7738077e47b5d5d1a67e281f26daf77c0eaf4bc13844096ba44de10e8
                                                                                          • Instruction ID: 755c83944b64191a63ae9fbe93a553eeb9176fc9fb172777ed2dff016c715320
                                                                                          • Opcode Fuzzy Hash: 9a28ede7738077e47b5d5d1a67e281f26daf77c0eaf4bc13844096ba44de10e8
                                                                                          • Instruction Fuzzy Hash: 3B01A232400319BBCB125FA4DC09FDA37A9FF08715F044026FE15A60A1E7B4C6158B98
                                                                                          APIs
                                                                                          • GetObjectW.GDI32(00000000,0000000C,?), ref: 0044D065
                                                                                          • SetBkColor.GDI32(00000000,00000000), ref: 0044D071
                                                                                          • GetSysColor.USER32(00000008), ref: 0044D081
                                                                                          • SetTextColor.GDI32(00000000,?), ref: 0044D08B
                                                                                            • Part of subcall function 00451C4F: GetWindowLongW.USER32(00000000,000000F0), ref: 00451C60
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Color$LongObjectTextWindow
                                                                                          • String ID:
                                                                                          • API String ID: 2871169696-0
                                                                                          • Opcode ID: 265342f7ee8a1153c7b51b5f14527dc827535ebb0eb674f6a1fbca1b5b86dbf4
                                                                                          • Instruction ID: 317723848b4185415f7019c3fcc03aa18e7f1dae47e45d0b2d323c18f5c6b646
                                                                                          • Opcode Fuzzy Hash: 265342f7ee8a1153c7b51b5f14527dc827535ebb0eb674f6a1fbca1b5b86dbf4
                                                                                          • Instruction Fuzzy Hash: 9601AD30800208EBFF255F64DC49BAF3B69AB00309F504562FE01C22E5D778CD92CA59
                                                                                          APIs
                                                                                          • GetWindowExtEx.GDI32(?,00433906,00000000,?,?,?,00433906,?,?,?,?,?,?,00000000,00000000), ref: 004511E6
                                                                                          • GetViewportExtEx.GDI32(?,?,?,00433906,?,?,?,?,?,?,00000000,00000000), ref: 004511F3
                                                                                          • MulDiv.KERNEL32(00433906,00000000,00000000), ref: 00451218
                                                                                          • MulDiv.KERNEL32(46892C46,00000000,00000000), ref: 00451233
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ViewportWindow
                                                                                          • String ID:
                                                                                          • API String ID: 1589084482-0
                                                                                          • Opcode ID: 7cd33b6ab4d2193f76cced18357ae4aca2b6ff735667db3ae68395e930c41526
                                                                                          • Instruction ID: 97f97ea6ec0af48171e3e0681942d4eede34368a31ec3b7833d6237cfbe17447
                                                                                          • Opcode Fuzzy Hash: 7cd33b6ab4d2193f76cced18357ae4aca2b6ff735667db3ae68395e930c41526
                                                                                          • Instruction Fuzzy Hash: 78F06D72400118BFEB04AB66EC06CAEBBBDEF44310B10046AF855920B1DBB2AD509F54
                                                                                          APIs
                                                                                          • GetWindowExtEx.GDI32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 0045124F
                                                                                          • GetViewportExtEx.GDI32(?,?,?,?,?,?,?,00000000,00000000), ref: 0045125C
                                                                                          • MulDiv.KERNEL32(?,00000000,00000000), ref: 00451281
                                                                                          • MulDiv.KERNEL32(00000002,00000000,00000000), ref: 0045129C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ViewportWindow
                                                                                          • String ID:
                                                                                          • API String ID: 1589084482-0
                                                                                          • Opcode ID: 21b1b109ebbfb106a0bfc3e6ae0bfd749b65d71abb819a1f98d960dcc19d790a
                                                                                          • Instruction ID: c87868c1a558fdfcab532434c32560e5d69437303f054a177c6d25d6d375bc17
                                                                                          • Opcode Fuzzy Hash: 21b1b109ebbfb106a0bfc3e6ae0bfd749b65d71abb819a1f98d960dcc19d790a
                                                                                          • Instruction Fuzzy Hash: B6F06D72400118BFEB04AB66EC06CAEBBBDEF44310B10046AF855920B1DBB2AD509F54
                                                                                          APIs
                                                                                          • lstrlenW.KERNEL32(?), ref: 00451D46
                                                                                          • GetWindowTextW.USER32(?,?,00000100), ref: 00451D62
                                                                                          • lstrcmpW.KERNEL32(?,?), ref: 00451D76
                                                                                          • SetWindowTextW.USER32(?,?), ref: 00451D86
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: TextWindow$lstrcmplstrlen
                                                                                          • String ID:
                                                                                          • API String ID: 330964273-0
                                                                                          • Opcode ID: 7b45ce04a9b1ae968a786b6d037a5a7cd73a3c99b54887aedf59d778940b4282
                                                                                          • Instruction ID: 1f8c5f06ff99a42155bbc88ffc3675b9a17a3dc1c46ce78469c10de00ca8b440
                                                                                          • Opcode Fuzzy Hash: 7b45ce04a9b1ae968a786b6d037a5a7cd73a3c99b54887aedf59d778940b4282
                                                                                          • Instruction Fuzzy Hash: 96F0F835400219BBDF216F25DC48BDE7B7DEB04392F048162FC59D6122D734EA589B98
                                                                                          APIs
                                                                                          • GetTickCount.KERNEL32 ref: 004548BC
                                                                                          • GetTickCount.KERNEL32 ref: 004548C9
                                                                                          • CoFreeUnusedLibraries.OLE32 ref: 004548D8
                                                                                          • GetTickCount.KERNEL32 ref: 004548DE
                                                                                            • Part of subcall function 0045483F: CoFreeUnusedLibraries.OLE32 ref: 00454887
                                                                                            • Part of subcall function 0045483F: OleUninitialize.OLE32 ref: 0045488D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CountTick$FreeLibrariesUnused$Uninitialize
                                                                                          • String ID:
                                                                                          • API String ID: 685759847-0
                                                                                          • Opcode ID: d3af5f9a3fe263e9c154d091c06c54d764bec4d6a9cff2194c392538f8a78b88
                                                                                          • Instruction ID: 9f056d0bbd8dd1596b1c18606dd7f9f6a60e016245d2b6d3ac418ffe466766da
                                                                                          • Opcode Fuzzy Hash: d3af5f9a3fe263e9c154d091c06c54d764bec4d6a9cff2194c392538f8a78b88
                                                                                          • Instruction Fuzzy Hash: 08E09B34404250CBC3107F71EC4461937E4EB9532BF10887BD86449126CB3489C8DF5D
                                                                                          APIs
                                                                                          • GetSysColor.USER32(00000010), ref: 00421129
                                                                                          • GetSysColor.USER32(00000010), ref: 00421132
                                                                                          • GetSysColor.USER32(00000004), ref: 0042113B
                                                                                          • GetSysColor.USER32(00000004), ref: 00421144
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Color
                                                                                          • String ID:
                                                                                          • API String ID: 2811717613-0
                                                                                          • Opcode ID: 4bd529fbd9a7e1504822243ca3a03a9fb09af208d7ec80951f3e9b5f7e63b2a9
                                                                                          • Instruction ID: 68b762aaa8fd10e4e4fda17325eda02c3eb7c3b881a7bc894316d080b8a83417
                                                                                          • Opcode Fuzzy Hash: 4bd529fbd9a7e1504822243ca3a03a9fb09af208d7ec80951f3e9b5f7e63b2a9
                                                                                          • Instruction Fuzzy Hash: 44D067B1D40368BAEB109FB57C097593EA4E7587A0F030937A3049B1A8EAB55441DF8C
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClearH_prologVariant
                                                                                          • String ID: @
                                                                                          • API String ID: 1166855276-2766056989
                                                                                          • Opcode ID: de01658691617cd7e8d3270ab01cbfcdb7138da2d485e19bc2bb08249b80124a
                                                                                          • Instruction ID: dc7523567a46785a17583489aa98722f108983a14c6109d566984421f6a54b3c
                                                                                          • Opcode Fuzzy Hash: de01658691617cd7e8d3270ab01cbfcdb7138da2d485e19bc2bb08249b80124a
                                                                                          • Instruction Fuzzy Hash: 1251A271A002099FDB04CFA9C988AEEB7F9FF48305F24456EE516E7251E774AA05CF60
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Info
                                                                                          • String ID: $
                                                                                          • API String ID: 1807457897-3032137957
                                                                                          • Opcode ID: bdd55a00670b080d7570cdf518e241fb2652f96bbfb8e861ea0cf9fafff650b8
                                                                                          • Instruction ID: 4cdfdc9a1c09ff160aabba4fc03ae3790a6e5fe504094784b9e3ccda3f66a4f8
                                                                                          • Opcode Fuzzy Hash: bdd55a00670b080d7570cdf518e241fb2652f96bbfb8e861ea0cf9fafff650b8
                                                                                          • Instruction Fuzzy Hash: 53417B310441982EFB119B68DD49BFB3FA9EB57700F1400FAD585E7192C6794A08C7AE
                                                                                          APIs
                                                                                          • IsChild.USER32(?,?), ref: 00438897
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 004388AE
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ChildLongWindow
                                                                                          • String ID: 0
                                                                                          • API String ID: 1178903432-4108050209
                                                                                          • Opcode ID: a4640b63f0e4d0018f1b4e683a1bfbd3b4e0b644a7a71a64234b53743c5d9be7
                                                                                          • Instruction ID: 318c568a18dd9bdf25c4cbdb37b599c958055bf930ad7c7f1db88c01b6885d44
                                                                                          • Opcode Fuzzy Hash: a4640b63f0e4d0018f1b4e683a1bfbd3b4e0b644a7a71a64234b53743c5d9be7
                                                                                          • Instruction Fuzzy Hash: 4A21E5A15043096ADB2566258D41BBFE6AD9F4D798F34342FFC01A6292DF2CCD0085AE
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileLastType
                                                                                          • String ID: @
                                                                                          • API String ID: 1621975986-2766056989
                                                                                          • Opcode ID: 561a0eb8261db60dea72f5c4cf07121acd5068d553469925d898d6020542c729
                                                                                          • Instruction ID: c733849545e408b7c9607131ad50abc2ddbbfd3afd24a80f40c120eacad41b72
                                                                                          • Opcode Fuzzy Hash: 561a0eb8261db60dea72f5c4cf07121acd5068d553469925d898d6020542c729
                                                                                          • Instruction Fuzzy Hash: 871127311C12481BDB102739CC05399BB055F0A339F18661BEAD5472D2C63DA970AB5F
                                                                                          APIs
                                                                                          • CreateFontW.GDI32(0000000D,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,Arial), ref: 004041E8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFont
                                                                                          • String ID: $$$$Arial
                                                                                          • API String ID: 1830492434-950431702
                                                                                          • Opcode ID: 24f5418ec38ea3e4c01a1048b2722176543ea3744aba676ec93efd38bb45c79b
                                                                                          • Instruction ID: 6198d0846da0c2a79b06bfff6584b572a69bdf997c4d15498639b44492db22c8
                                                                                          • Opcode Fuzzy Hash: 24f5418ec38ea3e4c01a1048b2722176543ea3744aba676ec93efd38bb45c79b
                                                                                          • Instruction Fuzzy Hash: 53117CF1540794AFE3248F0A8D81B27FBECFB44794F50492EF25597681C3B9AC048B65
                                                                                          APIs
                                                                                          • GetWindow.USER32(?,00000005), ref: 00445C15
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 00445C22
                                                                                          • SetTextColor.GDI32(?,?), ref: 00445C3F
                                                                                          • SetBkColor.GDI32(?,?), ref: 00445C4D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ColorWindow$LongText
                                                                                          • String ID: TgD
                                                                                          • API String ID: 3945788684-3489212311
                                                                                          • Opcode ID: a8dd4c1ade11748855ea82245dadcf572beb37ecab760919a9101596a426362a
                                                                                          • Instruction ID: 3de5023e001d5f24e9c8c72be63f6612de53abbf279ad913a82cd6b063120ee7
                                                                                          • Opcode Fuzzy Hash: a8dd4c1ade11748855ea82245dadcf572beb37ecab760919a9101596a426362a
                                                                                          • Instruction Fuzzy Hash: B0F0A031106B2487FE30CB64AC88BAFA3A1FB12350F104C27E000D6192D72C9952C28E
                                                                                          APIs
                                                                                          • GetClassNameA.USER32(?,?,00000010), ref: 004469BE
                                                                                          • lstrcmpA.KERNEL32(?,ComboBox,?,00000010), ref: 004469CE
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClassNamelstrcmp
                                                                                          • String ID: ComboBox
                                                                                          • API String ID: 3770760073-1152790111
                                                                                          • Opcode ID: 638b6d5b5dd74d3f8b6447173f4e9db223da21383933387dfa3dc629b15945e6
                                                                                          • Instruction ID: eb78fe26db933e5c72342ac538c726c280754b38a21e6147770e76da457deae3
                                                                                          • Opcode Fuzzy Hash: 638b6d5b5dd74d3f8b6447173f4e9db223da21383933387dfa3dc629b15945e6
                                                                                          • Instruction Fuzzy Hash: C0E04FB06002015BE724AF248C0AB6A32A8F750705F944D6EF149C2191F7B9D665965B
                                                                                          APIs
                                                                                          • FindWindowW.USER32(00000000,Ghost Queen_Gaming_Mouse_Normal_Monitor), ref: 0040EE67
                                                                                          • SendMessageW.USER32(00000000,000004C8,00000000,00000000), ref: 0040EE7E
                                                                                          Strings
                                                                                          • Ghost Queen_Gaming_Mouse_Normal_Monitor, xrefs: 0040EE60
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: FindMessageSendWindow
                                                                                          • String ID: Ghost Queen_Gaming_Mouse_Normal_Monitor
                                                                                          • API String ID: 1741975844-2436140786
                                                                                          • Opcode ID: 9d784bc6b3cfa8e3737c1ff54ef9a485bf34e0d6ccb557dd468e35105077b299
                                                                                          • Instruction ID: 5b0fa04bf5f4fe72b78ded7ab8b2098e478eaa4ca38dc62b3639bbc4dba13bdd
                                                                                          • Opcode Fuzzy Hash: 9d784bc6b3cfa8e3737c1ff54ef9a485bf34e0d6ccb557dd468e35105077b299
                                                                                          • Instruction Fuzzy Hash: BFC012743C130836F3A82AA2AC0AF0625587730F07F508422F248E91D0F5A89414862D
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: Gdip$BrushDeleteFree
                                                                                          • String ID: `=@
                                                                                          • API String ID: 1154336399-2879527708
                                                                                          • Opcode ID: dc98935804b9f7e2c0ddf4ea5c0f2b8daaab034e6b574e9cf20da8cddf9de890
                                                                                          • Instruction ID: dd3cd2d243befb0bdc8a58264798aa3a99adde189eac4b25318929466c42d8d6
                                                                                          • Opcode Fuzzy Hash: dc98935804b9f7e2c0ddf4ea5c0f2b8daaab034e6b574e9cf20da8cddf9de890
                                                                                          • Instruction Fuzzy Hash: F9D0127110572112D225AB799445B8BAECC5F55309F55881FF988E3342C7BC8D85839D
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(00498618,?,00000000,?,?,0045409D,00000010,?,00000000,?,?,?,004534AA,Vht ,00452F3F,004534B0), ref: 004543EC
                                                                                          • InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,0045409D,00000010,?,00000000,?,?,?,004534AA,Vht ,00452F3F,004534B0), ref: 004543FE
                                                                                          • LeaveCriticalSection.KERNEL32(00498618,?,00000000,?,?,0045409D,00000010,?,00000000,?,?,?,004534AA,Vht ,00452F3F,004534B0), ref: 00454407
                                                                                          • EnterCriticalSection.KERNEL32(00000000,00000000,?,?,0045409D,00000010,?,00000000,?,?,?,004534AA,Vht ,00452F3F,004534B0,0044ECC0), ref: 00454419
                                                                                            • Part of subcall function 0045431E: GetVersion.KERNEL32(?,004543C1,?,0045409D,00000010,?,00000000,?,?,?,004534AA,Vht ,00452F3F,004534B0,0044ECC0,00450B36), ref: 00454331
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$Enter$InitializeLeaveVersion
                                                                                          • String ID:
                                                                                          • API String ID: 1193629340-0
                                                                                          • Opcode ID: 48a58fd1c4d3f5fc27f094fb1826e9433353cc7b1d1bd51846114e5e47439932
                                                                                          • Instruction ID: bf903e922495f3838b489cf5f4aeb865ec4149ebdadf97216c07714411b6f068
                                                                                          • Opcode Fuzzy Hash: 48a58fd1c4d3f5fc27f094fb1826e9433353cc7b1d1bd51846114e5e47439932
                                                                                          • Instruction Fuzzy Hash: 3AF0817100021ADFC7109F59EC80956B369FB6631BB40443BE94587123DB34E8ADCAAC
                                                                                          APIs
                                                                                          • InitializeCriticalSection.KERNEL32(?,0043C665,?,0043910C), ref: 0043D788
                                                                                          • InitializeCriticalSection.KERNEL32(?,0043C665,?,0043910C), ref: 0043D790
                                                                                          • InitializeCriticalSection.KERNEL32(?,0043C665,?,0043910C), ref: 0043D798
                                                                                          • InitializeCriticalSection.KERNEL32(?,0043C665,?,0043910C), ref: 0043D7A0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000005.00000002.2949313660.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000005.00000002.2949247027.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949470233.000000000045E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949535277.0000000000471000.00000008.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000472000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949598336.0000000000496000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000049B000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DC000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004DF000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.00000000004EE000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          • Associated: 00000005.00000002.2949733223.000000000050E000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_5_2_400000_Option.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalInitializeSection
                                                                                          • String ID:
                                                                                          • API String ID: 32694325-0
                                                                                          • Opcode ID: ea7bc71e2e2b911da6adecbdcf1ee6eca6f7041096d8785a4889d7dcf7fb1521
                                                                                          • Instruction ID: 98c45f012232b5c54b7be2a9151f8b3db3082d4d1c4a1585502824319093f28d
                                                                                          • Opcode Fuzzy Hash: ea7bc71e2e2b911da6adecbdcf1ee6eca6f7041096d8785a4889d7dcf7fb1521
                                                                                          • Instruction Fuzzy Hash: 10C002F5911336AECB192F65FC048457F25EB04662311C073E54C5213486229E91FFD8