Loading ...

Play interactive tourEdit tour

Analysis Report #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.bat

Overview

General Information

Sample Name:#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.bat (renamed file extension from bat to exe)
Analysis ID:343504
MD5:6665909a2652c5860fd874cb15c3991c
SHA1:84a5a2e920e8165634e510766eaa51662401a227
SHA256:1ef7ae3509e71c3cd0904a7396831e6bd2c021f14dc5d4b2485a38ebefc3dd3d

Most interesting Screenshot:

Detection

Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Abnormal high CPU Usage
Checks for available system drives (often done to infect USB drives)
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Enables security privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
PE file contains strange resources
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe (PID: 4164 cmdline: 'C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe' MD5: 6665909A2652C5860FD874CB15C3991C)
    • zr.exe (PID: 6340 cmdline: 'C:\Users\user\zT6Nm@i4\zr.exe' a 'C:\Users\user\zT6Nm@i4\111.7z' 'C:\Users\user\zT6Nm@i4\TXP\*' MD5: 045FCBE6C174AFA9A6A998BDD6F9FAD7)
      • conhost.exe (PID: 6356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 6648 cmdline: 'C:\Windows\System32\cmd.exe' /C 'C:\Users\user\zT6Nm@i4\copy.bat' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • conhost.exe (PID: 6700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • PMRunner64.exe (PID: 7120 cmdline: 'C:\Users\user\zT6Nm@i4\PMRunner64.exe' MD5: 65DBB57517611D9DE8CE522022DCD727)
  • zr.exe (PID: 6800 cmdline: 'C:\ProgramData\Microsoft\zr.exe' x C:\ProgramData\Microsoft\111.7z -y MD5: 045FCBE6C174AFA9A6A998BDD6F9FAD7)
    • conhost.exe (PID: 6656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • PMRunner64.exe (PID: 6492 cmdline: 'C:\Users\user\zT6Nm@i4\PMRunner64.exe' MD5: 65DBB57517611D9DE8CE522022DCD727)
  • PMRunner64.exe (PID: 6972 cmdline: 'C:\Users\user\zT6Nm@i4\PMRunner64.exe' MD5: 65DBB57517611D9DE8CE522022DCD727)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\zT6Nm@i4\ru2.urlMethodology_Suspicious_Shortcut_Local_URLDetects local script usage for .URL persistence@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)
  • 0x13:$file: URL=file:///
  • 0x0:$url_explicit: [InternetShortcut]

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Multi AV Scanner detection for submitted fileShow sources
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeVirustotal: Detection: 15%Perma Link
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeReversingLabs: Detection: 22%

Privilege Escalation:

barindex
Contains functionality to bypass UAC (CMSTPLUA)Show sources
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000180002D40 CoGetObject,CoGetObject,Sleep,SleepEx,0_2_0000000180002D40

Compliance:

barindex
Binary contains paths to debug symbolsShow sources
Source: Binary string: C:\sourcetree\CortexCommon\Razer.ProcessManager\PMManager\x64\Release\PMRunner.pdb source: PMRunner64.exe, 0000000C.00000000.685253001.00007FF7A5177000.00000002.00020000.sdmp, PMRunner64.exe, 0000000E.00000000.707315840.00007FF7A5177000.00000002.00020000.sdmp, PMRunner64.exe, 0000000F.00000000.724614077.00007FF7A5177000.00000002.00020000.sdmp, PMRunner64.exe.0.dr
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: z:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: x:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: v:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: t:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: r:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: p:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: n:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: l:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: j:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: h:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: f:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: b:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: y:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: w:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: u:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: s:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: q:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: o:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: m:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: k:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: i:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: g:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: e:Jump to behavior
Source: C:\Windows\System32\conhost.exeFile opened: c:Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: [:Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400223C0 GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,0_2_00000001400223C0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00405BD6 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,1_2_00405BD6
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0040755D FindFirstFileW,1_2_0040755D
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00406532 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,1_2_00406532
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\TXP\Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Programs\Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Programs\Startup\Realtek???????? .lnkJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Jump to behavior

Networking:

barindex
Connects to many ports of the same IP (likely port scanning)Show sources
Source: global trafficTCP traffic: 110.92.66.246 ports 1,2,13527,3,5,7
Uses known network protocols on non-standard portsShow sources
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 13527
Source: unknownNetwork traffic detected: HTTP traffic on port 13527 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 13527
Source: unknownNetwork traffic detected: HTTP traffic on port 13527 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 13527
Source: unknownNetwork traffic detected: HTTP traffic on port 13527 -> 49746
Source: global trafficTCP traffic: 192.168.2.4:49744 -> 110.92.66.246:13527
Source: global trafficHTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: FCzEFfJJGECxZCsRaGKFlJqHWSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 110.92.66.246:13527
Source: global trafficHTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: hVvGEJDDITDIJDJeQLtIKCsnCSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 110.92.66.246:13527
Source: global trafficHTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: IKBXBepAaaBfkIYjnCKuMRKkFSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 110.92.66.246:13527
Source: Joe Sandbox ViewIP Address: 204.79.197.200 204.79.197.200
Source: Joe Sandbox ViewASN Name: HKKFGL-AS-APHKKwaifongGroupLimitedHK HKKFGL-AS-APHKKwaifongGroupLimitedHK
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 104.79.89.181
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.31.135
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140002220 recv,SendMessageW,_cwprintf_s_l,inet_ntoa,_cwprintf_s_l,inet_ntoa,_cwprintf_s_l,_cwprintf_s_l,_cwprintf_s_l,htons,_cwprintf_s_l,0_2_0000000140002220
Source: global trafficHTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: FCzEFfJJGECxZCsRaGKFlJqHWSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 110.92.66.246:13527
Source: global trafficHTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: hVvGEJDDITDIJDJeQLtIKCsnCSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 110.92.66.246:13527
Source: global trafficHTTP traffic detected: GET /\ HTTP/1.1Connection: UpgradeSec-WebSocket-Key: IKBXBepAaaBfkIYjnCKuMRKkFSec-WebSocket-Version: 13Upgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: 110.92.66.246:13527
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://ocsp.digicert.com0O
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://ocsp.thawte.com0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://s2.symcb.com0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://sv.symcd.com0&
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://th.symcb.com/th.crl0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://th.symcb.com/th.crt0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://th.symcd.com0&
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://www.digicert.com/CPS0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: http://www.nsecsoft.com
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://www.symauth.com/cps0(
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: http://www.symauth.com/rpa00
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: https://d.symcb.com/cps0%
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: https://d.symcb.com/rpa0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drString found in binary or memory: https://www.digicert.com/CPS0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: https://www.thawte.com/cps0
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: https://www.thawte.com/cps0/
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drString found in binary or memory: https://www.thawte.com/repository0W
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49696
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49683
Source: unknownNetwork traffic detected: HTTP traffic on port 49696 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49682
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49681
Source: unknownNetwork traffic detected: HTTP traffic on port 49683 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 49682 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49681 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400DC700 CreateCompatibleDC,CreateCompatibleBitmap,FillRect,OpenClipboard,EmptyClipboard,CloseClipboard,SetClipboardData,CloseClipboard,0_2_00000001400DC700
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400900A0 IsWindow,GetFocus,IsChild,SendMessageW,IsChild,SendMessageW,GetFocus,IsIconic,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,IsWindowVisible,0_2_00000001400900A0
Source: zr.exe, 00000001.00000002.653437096.0000000000708000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014007AAC4 MessageBeep,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,0_2_000000014007AAC4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140085328 GetParent,ScreenToClient,free,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,0_2_0000000140085328
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014000F35C GetKeyState,GetKeyState,GetKeyState,SendMessageW,0_2_000000014000F35C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014008F93C GetKeyState,GetKeyState,GetKeyState,0_2_000000014008F93C
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeProcess Stats: CPU usage > 98%
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00406D20: __EH_prolog,GetFileInformationByHandle,DeviceIoControl,memcpy,1_2_00406D20
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014002007C0_2_000000014002007C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400118180_2_0000000140011818
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400760740_2_0000000140076074
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014010E08C0_2_000000014010E08C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400BE1D00_2_00000001400BE1D0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014005A1C40_2_000000014005A1C4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001401623540_2_0000000140162354
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014005C3D40_2_000000014005C3D4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014007A4D80_2_000000014007A4D8
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400365D80_2_00000001400365D8
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400466140_2_0000000140046614
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014003C6440_2_000000014003C644
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014005A6940_2_000000014005A694
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400DE6A40_2_00000001400DE6A4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014004472C0_2_000000014004472C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014000A7600_2_000000014000A760
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400BE7980_2_00000001400BE798
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014006C8BC0_2_000000014006C8BC
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400768F80_2_00000001400768F8
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400749340_2_0000000140074934
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014002C9600_2_000000014002C960
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140018AB80_2_0000000140018AB8
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140014AD00_2_0000000140014AD0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014005EAE40_2_000000014005EAE4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140040B540_2_0000000140040B54
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140092B980_2_0000000140092B98
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140024BFC0_2_0000000140024BFC
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140084BF40_2_0000000140084BF4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140090C1C0_2_0000000140090C1C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014005AD180_2_000000014005AD18
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140078D580_2_0000000140078D58
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140042E180_2_0000000140042E18
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140018EA00_2_0000000140018EA0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400F0FA40_2_00000001400F0FA4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400211000_2_0000000140021100
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014003910C0_2_000000014003910C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400293080_2_0000000140029308
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014005F3040_2_000000014005F304
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400BF3040_2_00000001400BF304
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400973280_2_0000000140097328
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400DF3500_2_00000001400DF350
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014009140C0_2_000000014009140C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400CB4B40_2_00000001400CB4B4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014003754C0_2_000000014003754C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014007564C0_2_000000014007564C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400816680_2_0000000140081668
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014001D68C0_2_000000014001D68C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001401636B00_2_00000001401636B0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400476E40_2_00000001400476E4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014002377C0_2_000000014002377C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400577E80_2_00000001400577E8
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400F18000_2_00000001400F1800
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400518800_2_0000000140051880
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400798A40_2_00000001400798A4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400638BC0_2_00000001400638BC
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001401578AC0_2_00000001401578AC
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400A38D00_2_00000001400A38D0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400918D40_2_00000001400918D4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014007DA440_2_000000014007DA44
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140161B540_2_0000000140161B54
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140087CCC0_2_0000000140087CCC
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140067CE40_2_0000000140067CE4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140159CFC0_2_0000000140159CFC
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400BBD900_2_00000001400BBD90
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400DFD940_2_00000001400DFD94
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140041DE40_2_0000000140041DE4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400A1E3C0_2_00000001400A1E3C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140043E5C0_2_0000000140043E5C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014005BE900_2_000000014005BE90
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140079EC00_2_0000000140079EC0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140161ED40_2_0000000140161ED4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400B9ED40_2_00000001400B9ED4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400BDED80_2_00000001400BDED8
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014006FF0C0_2_000000014006FF0C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140047F400_2_0000000140047F40
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014000DF9C0_2_000000014000DF9C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014006BFC40_2_000000014006BFC4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000018000C3800_2_000000018000C380
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001800088E00_2_00000001800088E0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001800090C00_2_00000001800090C0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000018000E2740_2_000000018000E274
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001800104F00_2_00000001800104F0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001800169000_2_0000000180016900
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000180006AE00_2_0000000180006AE0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_004292EC1_2_004292EC
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_004419AF1_2_004419AF
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0044C0C81_2_0044C0C8
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0044C0A01_2_0044C0A0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0044017B1_2_0044017B
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0045A1901_2_0045A190
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0041C3CB1_2_0041C3CB
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0041A4591_2_0041A459
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_004566501_2_00456650
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0043674E1_2_0043674E
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0044C8A01_2_0044C8A0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_004509E81_2_004509E8
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0044C9B01_2_0044C9B0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0044AC501_2_0044AC50
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00454F001_2_00454F00
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00452FB01_2_00452FB0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_004511501_2_00451150
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0045B4231_2_0045B423
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_004575D01_2_004575D0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0045B5B11_2_0045B5B1
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_004015BE1_2_004015BE
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0045B68B1_2_0045B68B
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0045B7711_2_0045B771
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_004159D71_2_004159D7
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_004019991_2_00401999
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00459AE01_2_00459AE0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00451B101_2_00451B10
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00459CA01_2_00459CA0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0040DDF11_2_0040DDF1
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0044BF301_2_0044BF30
Source: C:\Users\user\zT6Nm@i4\zr.exeProcess token adjusted: SecurityJump to behavior
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: String function: 00401CC2 appears 153 times
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: String function: 0045AD30 appears 480 times
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: K_FPS64.dll.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: K_FPS64.dll.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: K_FPS64.dll.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PMRunner64.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmpBinary or memory string: OriginalFilename7zr.exe, vs #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000002.686343189.0000000002530000.00000002.00000001.sdmpBinary or memory string: originalfilename vs #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000002.686343189.0000000002530000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000002.686174201.0000000002430000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000002.686004489.00000000020D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000002.686469830.00000000026C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameWindows.Storage.dll.MUIj% vs #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000002.686358301.0000000002550000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameSHELL32.DLL.MUIj% vs #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeSection loaded: devenum.dllJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeSection loaded: msdmo.dllJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\zT6Nm@i4\ru2.url, type: DROPPEDMatched rule: Methodology_Suspicious_Shortcut_Local_URL author = @itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson), description = Detects local script usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: classification engineClassification label: mal72.troj.expl.evad.winEXE@13/17@0/5
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00414942 __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,1_2_00414942
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00407CF5 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,1_2_00407CF5
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014001E7FC CoInitialize,CoCreateInstance,0_2_000000014001E7FC
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400081A8 FindResourceW,LoadResource,LockResource,FreeResource,0_2_00000001400081A8
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile created: C:\Users\user\zT6Nm@i4Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeMutant created: \Sessions\1\BaseNamedObjects\V 5i
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeMutant created: \Sessions\1\BaseNamedObjects\Random name
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6700:120:WilError_01
Source: unknownProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /C 'C:\Users\user\zT6Nm@i4\copy.bat'
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeVirustotal: Detection: 15%
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeReversingLabs: Detection: 22%
Source: unknownProcess created: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe 'C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe'
Source: unknownProcess created: C:\Users\user\zT6Nm@i4\zr.exe 'C:\Users\user\zT6Nm@i4\zr.exe' a 'C:\Users\user\zT6Nm@i4\111.7z' 'C:\Users\user\zT6Nm@i4\TXP\*'
Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /C 'C:\Users\user\zT6Nm@i4\copy.bat'
Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\ProgramData\Microsoft\zr.exe 'C:\ProgramData\Microsoft\zr.exe' x C:\ProgramData\Microsoft\111.7z -y
Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Users\user\zT6Nm@i4\PMRunner64.exe 'C:\Users\user\zT6Nm@i4\PMRunner64.exe'
Source: unknownProcess created: C:\Users\user\zT6Nm@i4\PMRunner64.exe 'C:\Users\user\zT6Nm@i4\PMRunner64.exe'
Source: unknownProcess created: C:\Users\user\zT6Nm@i4\PMRunner64.exe 'C:\Users\user\zT6Nm@i4\PMRunner64.exe'
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess created: C:\Users\user\zT6Nm@i4\zr.exe 'C:\Users\user\zT6Nm@i4\zr.exe' a 'C:\Users\user\zT6Nm@i4\111.7z' 'C:\Users\user\zT6Nm@i4\TXP\*'Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /C 'C:\Users\user\zT6Nm@i4\copy.bat' Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess created: C:\Users\user\zT6Nm@i4\PMRunner64.exe 'C:\Users\user\zT6Nm@i4\PMRunner64.exe' Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeStatic file information: File size 3150336 > 1048576
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x179c00
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeStatic PE information: More than 200 imports for USER32.dll
Source: Binary string: C:\sourcetree\CortexCommon\Razer.ProcessManager\PMManager\x64\Release\PMRunner.pdb source: PMRunner64.exe, 0000000C.00000000.685253001.00007FF7A5177000.00000002.00020000.sdmp, PMRunner64.exe, 0000000E.00000000.707315840.00007FF7A5177000.00000002.00020000.sdmp, PMRunner64.exe, 0000000F.00000000.724614077.00007FF7A5177000.00000002.00020000.sdmp, PMRunner64.exe.0.dr
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140032378 GetModuleHandleW,LoadLibraryW,GetProcAddress,0_2_0000000140032378
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeStatic PE information: section name: text
Source: zr.exe.0.drStatic PE information: section name: .sxdata
Source: zr.exe.3.drStatic PE information: section name: .sxdata
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0044C2D0 push ecx; mov dword ptr [esp], ecx1_2_0044C2D1
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0045AD30 push eax; ret 1_2_0045AD4E
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0045B0E0 push eax; ret 1_2_0045B10E
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile created: C:\Users\user\zT6Nm@i4\PMRunner64.exeJump to dropped file
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile created: C:\Users\user\zT6Nm@i4\zr.exeJump to dropped file
Source: C:\Windows\System32\cmd.exeFile created: C:\ProgramData\Microsoft\zr.exeJump to dropped file
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile created: C:\Users\user\zT6Nm@i4\K_FPS64.dllJump to dropped file
Source: C:\Windows\System32\cmd.exeFile created: C:\ProgramData\Microsoft\zr.exeJump to dropped file
Source: C:\ProgramData\Microsoft\zr.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Realtek???????? .lnkJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile created: C:\Users\user\zT6Nm@i4\TXP\Windows\Start MenuJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile created: C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\ProgramsJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile created: C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Programs\StartupJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile created: C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Programs\Startup\Realtek???????? .lnkJump to behavior
Source: C:\ProgramData\Microsoft\zr.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Realtek???????? .lnkJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NULLJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NULLJump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Uses known network protocols on non-standard portsShow sources
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 13527
Source: unknownNetwork traffic detected: HTTP traffic on port 13527 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 13527
Source: unknownNetwork traffic detected: HTTP traffic on port 13527 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 13527
Source: unknownNetwork traffic detected: HTTP traffic on port 13527 -> 49746
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400025A0 IsIconic,SendMessageW,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,0_2_00000001400025A0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140038030 IsIconic,0_2_0000000140038030
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400900A0 IsWindow,GetFocus,IsChild,SendMessageW,IsChild,SendMessageW,GetFocus,IsIconic,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,IsWindowVisible,0_2_00000001400900A0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400926C4 IsIconic,PostMessageW,0_2_00000001400926C4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400668D4 IsWindowVisible,IsIconic,0_2_00000001400668D4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140090DC0 GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,0_2_0000000140090DC0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140090DC0 GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,0_2_0000000140090DC0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140090DC0 GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,0_2_0000000140090DC0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140091184 IsWindowVisible,ScreenToClient,GetSystemMetrics,GetSystemMetrics,IsIconic,GetSystemMetrics,PtInRect,PtInRect,GetSystemMetrics,PtInRect,0_2_0000000140091184
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140045388 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,GetParent,SendMessageW,UpdateWindow,GetParent,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,0_2_0000000140045388
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400918D4 IsWindowVisible,GetWindowRect,PtInRect,GetAsyncKeyState,ScreenToClient,PtInRect,SendMessageW,IsWindow,IsWindow,GetWindowRect,PtInRect,SendMessageW,ScreenToClient,PtInRect,GetParent,SendMessageW,SendMessageW,GetFocus,WindowFromPoint,GetSystemMenu,IsMenu,EnableMenuItem,EnableMenuItem,IsZoomed,IsIconic,EnableMenuItem,TrackPopupMenu,SendMessageW,0_2_00000001400918D4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140037F50 SetForegroundWindow,IsIconic,0_2_0000000140037F50
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000018000C380 RtlEncodePointer,_initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_000000018000C380
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)Show sources
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
Source: K_FPS64.dll.0.drBinary or memory string: OLLYDBG.EXEPROCESSHACKER.EXETCPVIEW.EXEAUTORUNS.EXEAUTORUNSC.EXEFILEMON.EXEPROCMON.EXEREGMON.EXEPROCEXP.EXEIDAQ.EXEIDAQ64.EXEIMMUNITYDEBUGGER.EXEWIRESHARK.EXEDUMPCAP.EXEHOOKEXPLORER.EXEIMPORTREC.EXEPETOOLS.EXELORDPE.EXESYSINSPECTOR.EXEPROC_ANALYZER.EXESYSANALYZER.EXESNIFF_HIT.EXEWINDBG.EXEJOEBOXCONTROL.EXEJOEBOXSERVER.EXERESOURCEHACKER.EXEX32DBG.EXEX64DBG.EXEFIDDLER.EXEHTTPDEBUGGER.EXERANDOM NAMEI AM CRITICAL FUNCTION, YOU SHOULD PROTECT AGAINST INT3 BPS %DPRL_CC.EXEPRL_TOOLS.EXECHECKING PARALLELS PROCESSES: %SHARDWARE\DEVICEMAP\SCSI\SCSI PORT 0\SCSI BUS 0\TARGET ID 0\LOGICAL UNIT ID 0IDENTIFIERQEMUCHECKING REG KEY %S QEMU-GA.EXECHECKING QEMU PROCESSES %S VBOXHARDWARE\DESCRIPTION\SYSTEMSYSTEMBIOSDATE06/23/99HARDWARE\ACPI\DSDT\VBOX__HARDWARE\ACPI\FADT\VBOX__HARDWARE\ACPI\RSDT\VBOX__SYSTEM\CONTROLSET001\SERVICES\VBOXGUESTSYSTEM\CONTROLSET001\SERVICES\VBOXMOUSESYSTEM\CONTROLSET001\SERVICES\VBOXSERVICESYSTEM\CONTROLSET001\SERVICES\VBOXSFSYSTEM\CONTROLSET001\SERVICES\VBOXVIDEOVBOXSERVICE.EXEVBOXTRAY.EXEVMSRVC.EXEVMUSRVC.EXECHECKING VIRTUAL PC PROCESSES %S SOFTWARE\MICROSOFT\VIRTUAL MACHINE\GUEST\PARAMETERSVMWAREHARDWARE\DEVICEMAP\SCSI\SCSI PORT 1\SCSI BUS 0\TARGET ID 0\LOGICAL UNIT ID 0HARDWARE\DEVICEMAP\SCSI\SCSI PORT 2\SCSI BUS 0\TARGET ID 0\LOGICAL UNIT ID 0SYSTEM\CONTROLSET001\CONTROL\SYSTEMINFORMATIONSYSTEMMANUFACTURERSYSTEMPRODUCTNAMECHECKING REG KEY %S
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: IdentifierJump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosDateJump to behavior
Source: C:\Windows\System32\conhost.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_0-68413
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeAPI coverage: 4.5 %
Source: C:\Users\user\zT6Nm@i4\zr.exeAPI coverage: 7.3 %
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exe TID: 6568Thread sleep count: 342 > 30Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exe TID: 6876Thread sleep count: 60 > 30Jump to behavior
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exe TID: 6884Thread sleep count: 45 > 30Jump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400223C0 GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,0_2_00000001400223C0
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00405BD6 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,1_2_00405BD6
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_0040755D FindFirstFileW,1_2_0040755D
Source: C:\Users\user\zT6Nm@i4\zr.exeCode function: 1_2_00406532 __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,1_2_00406532
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014015892C VirtualQuery,GetSystemInfo,SetThreadStackGuarantee,VirtualAlloc,VirtualProtect,0_2_000000014015892C
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\TXP\Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Programs\Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Programs\Startup\Realtek???????? .lnkJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeFile opened: C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Jump to behavior
Source: K_FPS64.dll.0.drBinary or memory string: ollydbg.exeProcessHacker.exetcpview.exeautoruns.exeautorunsc.exefilemon.exeprocmon.exeregmon.exeprocexp.exeidaq.exeidaq64.exeImmunityDebugger.exeWireshark.exedumpcap.exeHookExplorer.exeImportREC.exePETools.exeLordPE.exeSysInspector.exeproc_analyzer.exesysAnalyzer.exesniff_hit.exewindbg.exejoeboxcontrol.exejoeboxserver.exeResourceHacker.exex32dbg.exex64dbg.exeFiddler.exehttpdebugger.exeRandom nameI am critical function, you should protect against int3 bps %dprl_cc.exeprl_tools.exeChecking Parallels processes: %sHARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0IdentifierQEMUChecking reg key %s qemu-ga.exeChecking qemu processes %s VBOXHARDWARE\Description\SystemSystemBiosDate06/23/99HARDWARE\ACPI\DSDT\VBOX__HARDWARE\ACPI\FADT\VBOX__HARDWARE\ACPI\RSDT\VBOX__SYSTEM\ControlSet001\Services\VBoxGuestSYSTEM\ControlSet001\Services\VBoxMouseSYSTEM\ControlSet001\Services\VBoxServiceSYSTEM\ControlSet001\Services\VBoxSFSYSTEM\ControlSet001\Services\VBoxVideovboxservice.exevboxtray.exeVMSrvc.exeVMUSrvc.exeChecking Virtual PC processes %s SOFTWARE\Microsoft\Virtual Machine\Guest\ParametersVMWAREHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0SYSTEM\ControlSet001\Control\SystemInformationSystemManufacturerSystemProductNameChecking reg key %s
Source: K_FPS64.dll.0.drBinary or memory string: 00:1C:14PV00:50:56Checking MAC starting with %svmtoolsd.exevmwaretray.exevmwareuser.exeVGAuthService.exevmacthlp.exeChecking VWware process %s kernel32.dllntdll.dllRtlGetVersionRtlAddFunctionTablentdll
Source: #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000002.685826678.0000000000641000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeAPI call chain: ExitProcess graph end nodegraph_0-68580
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeAPI call chain: ExitProcess graph end nodegraph_0-67129
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014015C7A0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_000000014015C7A0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000180014870 RtlEncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,0_2_0000000180014870
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140032378 GetModuleHandleW,LoadLibraryW,GetProcAddress,0_2_0000000140032378
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140002BFC VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualAlloc,0_2_0000000140002BFC
Source: C:\Users\user\zT6Nm@i4\PMRunner64.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_000000014015C7A0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_000000014015C7A0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140154B40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_0000000140154B40
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001800090C0 SetFileAttributesW,Sleep,SleepEx,ShellExecuteExW,Sleep,SleepEx,DeleteFileW,ShellExecuteW,Sleep,SleepEx,DeleteFileW,DeleteFileW,DeleteFileW,Sleep,SleepEx,DeleteFileW,DeleteFileW,DeleteFileW,Sleep,SleepEx,ShellExecuteExW,DeleteFileW,DeleteFileW,DeleteFileW,0_2_00000001800090C0
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess created: C:\Users\user\zT6Nm@i4\zr.exe 'C:\Users\user\zT6Nm@i4\zr.exe' a 'C:\Users\user\zT6Nm@i4\111.7z' 'C:\Users\user\zT6Nm@i4\TXP\*'Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /C 'C:\Users\user\zT6Nm@i4\copy.bat' Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeProcess created: C:\Users\user\zT6Nm@i4\PMRunner64.exe 'C:\Users\user\zT6Nm@i4\PMRunner64.exe' Jump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: _cwprintf_s_l,GetNumberFormatW,GetLocaleInfoW,lstrlenW,0_2_000000014006CC48
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: GetProcAddress,_errno,GetUserDefaultUILanguage,ConvertDefaultLocale,ConvertDefaultLocale,GetSystemDefaultUILanguage,ConvertDefaultLocale,ConvertDefaultLocale,GetModuleFileNameW,GetLocaleInfoW,_errno,_errno,_snwprintf_s,_errno,_errno,_errno,LoadLibraryW,0_2_0000000140003520
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140154D44 GetSystemTimeAsFileTime,0_2_0000000140154D44
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140161ED4 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_0000000140161ED4
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_00000001400206A8 GetVersionExW,GetSystemMetrics,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00000001400206A8
Source: C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exeCode function: 0_2_0000000140001D04 WSAStartup,WSASocketW,gethostname,gethostbyname,inet_ntoa,htons,bind,WSAIoctl,0_2_0000000140001D04

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Replication Through Removable Media1Scripting1Startup Items1Startup Items1Deobfuscate/Decode Files or Information1Input Capture31System Time Discovery2Replication Through Removable Media1Archive Collected Data1Exfiltration Over Other Network MediumIngress Tool Transfer2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsNative API2DLL Side-Loading1Exploitation for Privilege Escalation1Scripting1LSASS MemoryPeripheral Device Discovery11Remote Desktop ProtocolInput Capture31Exfiltration Over BluetoothEncrypted Channel12Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Application Shimming1DLL Side-Loading1Obfuscated Files or Information2Security Account ManagerFile and Directory Discovery4SMB/Windows Admin SharesClipboard Data1Automated ExfiltrationNon-Standard Port11Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Registry Run Keys / Startup Folder21Application Shimming1DLL Side-Loading1NTDSSystem Information Discovery25Distributed Component Object ModelInput CaptureScheduled TransferNon-Application Layer Protocol1SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptBypass User Access Control1Bypass User Access Control1LSA SecretsQuery Registry1SSHKeyloggingData Transfer Size LimitsApplication Layer Protocol2Manipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonAccess Token Manipulation1Masquerading1Cached Domain CredentialsSecurity Software Discovery241VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsProcess Injection11Virtualization/Sandbox Evasion2DCSyncVirtualization/Sandbox Evasion2Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobRegistry Run Keys / Startup Folder21Access Token Manipulation1Proc FilesystemProcess Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Process Injection11/etc/passwd and /etc/shadowApplication Window Discovery1Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 343504 Sample: #U5e74#U7ec8#U63d0#U6210#U5... Startdate: 24/01/2021 Architecture: WINDOWS Score: 72 49 Multi AV Scanner detection for submitted file 2->49 51 Connects to many ports of the same IP (likely port scanning) 2->51 53 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->53 55 Uses known network protocols on non-standard ports 2->55 7 #U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe 3 17 2->7         started        12 PMRunner64.exe 2->12         started        14 PMRunner64.exe 2->14         started        16 zr.exe 10 2->16         started        process3 dnsIp4 43 204.79.197.200, 443, 49696, 49698 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 7->43 45 40.126.31.135, 443, 49681, 49682 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 7->45 47 2 other IPs or domains 7->47 35 C:\Users\user\zT6Nm@i4\PMRunner64.exe, PE32+ 7->35 dropped 37 C:\Users\user\zT6Nm@i4\K_FPS64.dll, PE32+ 7->37 dropped 39 C:\Users\user\zT6Nm@i4\zr.exe, PE32 7->39 dropped 59 Contains functionality to bypass UAC (CMSTPLUA) 7->59 18 PMRunner64.exe 2 1 7->18         started        22 cmd.exe 3 7->22         started        25 zr.exe 2 7->25         started        61 Tries to detect sandboxes / dynamic malware analysis system (registry check) 12->61 27 conhost.exe 1 16->27         started        file5 signatures6 process7 dnsIp8 41 110.92.66.246, 13527, 49744, 49745 HKKFGL-AS-APHKKwaifongGroupLimitedHK Hong Kong 18->41 57 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->57 33 C:\ProgramData\Microsoft\zr.exe, PE32 22->33 dropped 29 conhost.exe 22->29         started        31 conhost.exe 1 25->31         started        file9 signatures10 process11

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe15%VirustotalBrowse
#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe22%ReversingLabsWin64.Trojan.CrypterX

Dropped Files

SourceDetectionScannerLabelLink
C:\ProgramData\Microsoft\zr.exe0%VirustotalBrowse
C:\ProgramData\Microsoft\zr.exe0%MetadefenderBrowse
C:\ProgramData\Microsoft\zr.exe0%ReversingLabs
C:\Users\user\zT6Nm@i4\K_FPS64.dll6%VirustotalBrowse
C:\Users\user\zT6Nm@i4\K_FPS64.dll10%ReversingLabsWin64.Trojan.Wacatac
C:\Users\user\zT6Nm@i4\PMRunner64.exe0%VirustotalBrowse
C:\Users\user\zT6Nm@i4\PMRunner64.exe0%MetadefenderBrowse
C:\Users\user\zT6Nm@i4\PMRunner64.exe0%ReversingLabs
C:\Users\user\zT6Nm@i4\zr.exe0%VirustotalBrowse
C:\Users\user\zT6Nm@i4\zr.exe0%MetadefenderBrowse
C:\Users\user\zT6Nm@i4\zr.exe0%ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.nsecsoft.com0%VirustotalBrowse
http://www.nsecsoft.com0%Avira URL Cloudsafe
http://ocsp.thawte.com00%URL Reputationsafe
http://ocsp.thawte.com00%URL Reputationsafe
http://ocsp.thawte.com00%URL Reputationsafe
http://ocsp.thawte.com00%URL Reputationsafe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

NameMaliciousAntivirus DetectionReputation
http://110.92.66.246:13527/\true
    unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://crl.thawte.com/ThawtePremiumServerCA.crl0#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drfalse
      high
      http://crl.thawte.com/ThawteTimestampingCA.crl0#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drfalse
        high
        https://www.thawte.com/cps0/#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drfalse
          high
          http://crl.thawte.com/ThawtePCA.crl0#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drfalse
            high
            http://www.symauth.com/cps0(#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drfalse
              high
              http://www.symauth.com/rpa00#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643759945.0000000000691000.00000004.00000001.sdmp, PMRunner64.exe.0.drfalse
                high
                https://www.thawte.com/cps0#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drfalse
                  high
                  http://www.nsecsoft.com#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drfalse
                  • 0%, Virustotal, Browse
                  • Avira URL Cloud: safe
                  unknown
                  https://www.thawte.com/repository0W#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drfalse
                    high
                    http://ocsp.thawte.com0#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe, 00000000.00000003.643844289.000000000069C000.00000004.00000001.sdmp, zr.exe.3.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown

                    Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public

                    IPDomainCountryFlagASNASN NameMalicious
                    40.126.31.135
                    unknownUnited States
                    8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    204.79.197.200
                    unknownUnited States
                    8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    110.92.66.246
                    unknownHong Kong
                    133115HKKFGL-AS-APHKKwaifongGroupLimitedHKtrue

                    Private

                    IP
                    192.168.2.1
                    192.168.2.4

                    General Information

                    Joe Sandbox Version:31.0.0 Red Diamond
                    Analysis ID:343504
                    Start date:24.01.2021
                    Start time:10:22:33
                    Joe Sandbox Product:CloudBasic
                    Overall analysis duration:0h 9m 19s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Sample file name:#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.bat (renamed file extension from bat to exe)
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                    Number of analysed new started processes analysed:17
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • HDC enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Detection:MAL
                    Classification:mal72.troj.expl.evad.winEXE@13/17@0/5
                    EGA Information:
                    • Successful, ratio: 66.7%
                    HDC Information:
                    • Successful, ratio: 12.2% (good quality ratio 9.2%)
                    • Quality average: 39.6%
                    • Quality standard deviation: 29.1%
                    HCA Information:
                    • Successful, ratio: 59%
                    • Number of executed functions: 58
                    • Number of non-executed functions: 310
                    Cookbook Comments:
                    • Adjust boot time
                    • Enable AMSI
                    Warnings:
                    Show All
                    • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                    • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe
                    • Excluded IPs from analysis (whitelisted): 40.88.32.150, 104.43.139.144, 51.104.139.180, 92.122.213.194, 92.122.213.247, 8.248.141.254, 8.253.204.249, 8.241.121.126, 67.27.157.254, 8.248.113.254
                    • Excluded domains from analysis (whitelisted): skypedataprdcoleus15.cloudapp.net, arc.msn.com.nsatc.net, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, a1449.dscg2.akamai.net, arc.msn.com, au-bg-shim.trafficmanager.net
                    • Report size exceeded maximum capacity and may have missing disassembly code.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    10:23:40AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\user\zT6Nm@i4\PMRunner64.exe
                    10:23:48AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\user\zT6Nm@i4\PMRunner64.exe

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                    204.79.197.2006.htmlGet hashmaliciousBrowse
                    • www.bing.com/favicon.ico
                    6.htmlGet hashmaliciousBrowse
                    • www.bing.com/favicon.ico

                    Domains

                    No context

                    ASN

                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                    HKKFGL-AS-APHKKwaifongGroupLimitedHKinsz.exeGet hashmaliciousBrowse
                    • 88.218.145.49
                    DOCUMENTO_MEDICO.docGet hashmaliciousBrowse
                    • 154.221.28.167
                    NI3651011817UL.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    BAL_46979369.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    427424855528075826480424.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    FILE_81380052.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    FILE_PO_09152020EX.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    DOC_PO_09152020EX.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    KH3117818420XX.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    XCP_87353228.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    BAL_PO_09152020EX.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    IO3812758081JW.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    BAL_53345761.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    FILE_PO_09152020EX.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    FILE_YZGLOSASM.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    BAL_3105782760272.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    VCG4PMFIB0AR.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    4502009880852.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    INV_PO_09152020EX.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    W_RS5947693334AJ.docGet hashmaliciousBrowse
                    • 103.210.237.241
                    MICROSOFT-CORP-MSN-AS-BLOCKUSShipping Document PL&BL Draft.exeGet hashmaliciousBrowse
                    • 52.165.230.236
                    397282_BHJ.LNKGet hashmaliciousBrowse
                    • 157.55.165.21
                    075782_NGD.LNKGet hashmaliciousBrowse
                    • 157.55.165.21
                    118.apkGet hashmaliciousBrowse
                    • 52.177.138.113
                    oHqMFmPndx.exeGet hashmaliciousBrowse
                    • 52.110.67.58
                    ID652411022142.vbsGet hashmaliciousBrowse
                    • 104.41.44.79
                    FileZilla_3.52.2_win64_sponsored-setup.exeGet hashmaliciousBrowse
                    • 104.208.16.0
                    mfpVTSmyz-Fichero.msiGet hashmaliciousBrowse
                    • 40.112.173.153
                    Proforma Invoice.exeGet hashmaliciousBrowse
                    • 52.97.170.34
                    ID196619484.vbsGet hashmaliciousBrowse
                    • 104.41.44.79
                    #Ud83d#Udcde stephane.viard@colt.net @ 1200 PM 1200 PM.pff.HTMGet hashmaliciousBrowse
                    • 104.41.163.16
                    57229937-122020-4-7676523.docGet hashmaliciousBrowse
                    • 52.165.155.237
                    20202237F.htmlGet hashmaliciousBrowse
                    • 52.239.172.132
                    demo.jsGet hashmaliciousBrowse
                    • 191.233.233.157
                    demo.jsGet hashmaliciousBrowse
                    • 191.233.233.157
                    E-DEKONT.exeGet hashmaliciousBrowse
                    • 52.97.144.178
                    PO-RY 001-21 Accuri.jarGet hashmaliciousBrowse
                    • 23.98.35.163
                    ID32256523109.vbsGet hashmaliciousBrowse
                    • 104.41.44.79
                    SHIPPING DOCUMENTS.exeGet hashmaliciousBrowse
                    • 20.190.63.69
                    DHL Notification -AWB DHL-2021011293002.exeGet hashmaliciousBrowse
                    • 52.97.201.82
                    MICROSOFT-CORP-MSN-AS-BLOCKUSShipping Document PL&BL Draft.exeGet hashmaliciousBrowse
                    • 52.165.230.236
                    397282_BHJ.LNKGet hashmaliciousBrowse
                    • 157.55.165.21
                    075782_NGD.LNKGet hashmaliciousBrowse
                    • 157.55.165.21
                    118.apkGet hashmaliciousBrowse
                    • 52.177.138.113
                    oHqMFmPndx.exeGet hashmaliciousBrowse
                    • 52.110.67.58
                    ID652411022142.vbsGet hashmaliciousBrowse
                    • 104.41.44.79
                    FileZilla_3.52.2_win64_sponsored-setup.exeGet hashmaliciousBrowse
                    • 104.208.16.0
                    mfpVTSmyz-Fichero.msiGet hashmaliciousBrowse
                    • 40.112.173.153
                    Proforma Invoice.exeGet hashmaliciousBrowse
                    • 52.97.170.34
                    ID196619484.vbsGet hashmaliciousBrowse
                    • 104.41.44.79
                    #Ud83d#Udcde stephane.viard@colt.net @ 1200 PM 1200 PM.pff.HTMGet hashmaliciousBrowse
                    • 104.41.163.16
                    57229937-122020-4-7676523.docGet hashmaliciousBrowse
                    • 52.165.155.237
                    20202237F.htmlGet hashmaliciousBrowse
                    • 52.239.172.132
                    demo.jsGet hashmaliciousBrowse
                    • 191.233.233.157
                    demo.jsGet hashmaliciousBrowse
                    • 191.233.233.157
                    E-DEKONT.exeGet hashmaliciousBrowse
                    • 52.97.144.178
                    PO-RY 001-21 Accuri.jarGet hashmaliciousBrowse
                    • 23.98.35.163
                    ID32256523109.vbsGet hashmaliciousBrowse
                    • 104.41.44.79
                    SHIPPING DOCUMENTS.exeGet hashmaliciousBrowse
                    • 20.190.63.69
                    DHL Notification -AWB DHL-2021011293002.exeGet hashmaliciousBrowse
                    • 52.97.201.82

                    JA3 Fingerprints

                    No context

                    Dropped Files

                    No context

                    Created / dropped Files

                    C:\ProgramData\Microsoft\111.7z
                    Process:C:\Windows\System32\cmd.exe
                    File Type:7-zip archive data, version 0.4
                    Category:dropped
                    Size (bytes):871
                    Entropy (8bit):7.6751333998200835
                    Encrypted:false
                    SSDEEP:24:CIOegEZhc5iZzVT78nOwNDSxEqrohfoi4:CLegEZnf8nhmtURoT
                    MD5:23AEFC140636655BE400C41403524704
                    SHA1:BD581B29370FD93ABF63BD2C02998A0EF2DFD2A4
                    SHA-256:D37575E0B66A925ACB5432CC7B706DA8985635B80B3D60C6C90F748D1F743505
                    SHA-512:2517137ABEE797FCA5E597A3826B7C02B1CB1EC045DAE4C1B493C8EE2070D6473DA9E7C584F8302D598DF11C687EE11BF2DDE9E33616243C6F94986CBD0A7AA0
                    Malicious:false
                    Reputation:low
                    Preview: 7z..'....A`.$.......#.........8.....l].&.0.!?...o..1b..V..pS.G.U.>............Gg..1>....;....>|*.P..D.H.ta......0ur4..F6..f.d.2..Vzr.....#.%..a...?.6.j8KM..$...Uh..{.{._.21.!....ui8..Y*..M...K.L+.6zE0.....S=..c......4.H...E}..z. D......k...P:3...c9.......7."....V........>..l......R.a.i.Pk.....?*.2.c...,.L.. .VC...ui...y^..[.$..%.ea........B...l-.....w.Ao.0.`.....Z>.......,\>.x...l..d......B.v.#P....a.8V.9`lw.f..J"r.._."9j...r".C.......?.L@..=.....9%...-..4...".[.....I...-...').(Dj.....`0L.Jq.;yZ.!w.i./..\2.e.....iCg...P....xr..9^...*....."..Q...V.V......... 0..M...q.).?uB...H.D..{Q.......[.4C..5....(:.{!\.u}5....*..{..'-..X=T.....3....Ed^.$...p..@.p.u/..........#.,..o.(iAk.HY-.}1./vF...].%...W.z@.@l.......gS........{...*.E.i.n..q.*]Y....H.=<.R.[..V%.!K-}.....v...y.M&..^....T..@....s...AZP.....t..........#....]......r...*...
                    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Realtek???????? .lnk
                    Process:C:\ProgramData\Microsoft\zr.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Jan 14 15:39:10 2021, mtime=Thu Jan 14 15:39:10 2021, atime=Thu Jan 14 15:39:10 2021, length=271704, window=hide
                    Category:dropped
                    Size (bytes):1791
                    Entropy (8bit):3.466273590595946
                    Encrypted:false
                    SSDEEP:24:8Z3AX3ighdUAfmqpdoe7KODlWJdo7aB6m:8Z3AnisOqjl2k0B6
                    MD5:5FF572CBE6B366349A9D3389D4A60CAC
                    SHA1:497C442D14F4A09D00C3294784ECA1DC43A6F4A2
                    SHA-256:16731A0D7B072BE60F580E93797D2E91F2DE970CF45C31EE7B9BAE52D4824B6E
                    SHA-512:6DF6B097BFF0B76EC465A886ABE72EBC7DB3C850E4FA7D8CE1D60A36F57E04E3063507D3F23F059AA7024E7E7162F8F298610AA1702E16217730B1EF79D176B8
                    Malicious:false
                    Reputation:low
                    Preview: L..................F.@.. ....K......K......K.....X%......................,.:..DG..Yr?.D..U..k0.&...&...........-....k.2...X,~.2.......t...CFSF..1.....8R.J7.zT6Nm@i4....t.Y^...H.g.3..(.....gVA.G..k...B......8R.J8R.J....3X.......................z.T.6.N.m.@.i.4...D.j.2.X%...R. .PMRUNN~1.EXE..N.......R..R......W........................P.M.R.u.n.n.e.r.6.4...e.x.e.......U...............-.......T..............w.....C:\Users\user\zT6Nm@i4\PMRunner64.exe........\.....\.....\.....\.....\.P.M.R.u.n.n.e.r.6.4...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.z.T.6.N.m.@.i.4.&.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.z.T.6.N.m.@.i.4.\.P.M.R.u.n.n.e.r.6.4...e.x.e.........%USERPROFILE%\zT6Nm@i4\PMRunner64.exe...............................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.z.T.6.N.m.@.i.4.\.P.M.R.u.n.n.e.r.6.4...e.x.e..........
                    C:\ProgramData\Microsoft\zr.exe
                    Process:C:\Windows\System32\cmd.exe
                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                    Category:dropped
                    Size (bytes):461088
                    Entropy (8bit):6.581027593342649
                    Encrypted:false
                    SSDEEP:12288:tUBwDn0mdLrMkNpj6hTEXRrn9VsArg1xi:tUu7t3GTEhrn9VsA+i
                    MD5:045FCBE6C174AFA9A6A998BDD6F9FAD7
                    SHA1:9F477006DC176608E953EF44902FCE17DDF8FCA3
                    SHA-256:08E510EF41795B4192650452D8E5482DBF71CEFAF9D67CFE02F60253D6023F96
                    SHA-512:59CE53DDA80567A3B3E19FA2FBE404B655CB4203170B1295B1E6C33B9EBD0B6D2526FB568255610E64FA5C29A6F5C464766CDD746E207FFD2D48DA36811D717B
                    Malicious:false
                    Antivirus:
                    • Antivirus: Virustotal, Detection: 0%, Browse
                    • Antivirus: Metadefender, Detection: 0%, Browse
                    • Antivirus: ReversingLabs, Detection: 0%
                    Reputation:low
                    Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................G..............J.......L..G............|.....H........Rich..........................PE..L......W........../..........X....................@..................................W..........................................x.......(............... ............................................................................................text...u........................... ..`.rdata..............................@..@.data...\k..........................@....sxdata......p......................@....rsrc...(...........................@..@........................................................................................................................................................................................................................................................................................
                    C:\Users\user\AppData\Roaming\Plugin32.dll
                    Process:C:\Users\user\zT6Nm@i4\PMRunner64.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):191488
                    Entropy (8bit):7.99619087524627
                    Encrypted:true
                    SSDEEP:3072:SGtyjkUNHHoDhFMFI0rciHPgZwkndg0WU15pI9SmDCPAuE1L3kaF/F1Dmq:S0yjkKHHAh9t4EbHI9SmDiAQWd1Dmq
                    MD5:F6773A1C5D1566F4BEBDBF81BDDDC57D
                    SHA1:38CC9D3391DE6AE3773076E23B528F9534E40471
                    SHA-256:5B672EE64618CCCBC94011E1BA713E5B6EFA574A8CCA18CC3653C499B2AF2202
                    SHA-512:63E4BE550A66783ADFA6D064BA4912A6440986D3AF396F608F3C7B0B9F830DB8BB718216824689E1CA23D636AE67838ADB49DC0DA3263C9D64D823FB15CC964C
                    Malicious:false
                    Reputation:low
                    Preview: U...u].Z....u.....D<(.8x.S....L..N..*.+^...^.r.!.........!.|u.N).Fa...L.;..{b..F.t.<.#.2=.}.r|.!l....KnR.F..4{Ih..5..\......L...Fm...4F)J..%(q..<...zE8..8...A..#.b...&*...\..Y.+^.,.......0..oi..`.g.kD.48.G....L.QNor..+2.&"..r.!.Q...".V....l7.@.)8!..h.C8.....:&=.@.1.I..~....bg.r..Z....vK..h.D\8..8....sBM..^..*5+^...~.r.!...u... .|.|..@V)8.%..+*.8......-..B{1.)..j..=.B..._.Z.....v...(.D.(.p8......L@.N/.*.+^.....rN!............|..@.)8.%.(+*.8.t..s:&}.@.1....>....b%.r..Z.U<`.v.....D.8..8.g..7.L..N..*.+^r...rNv&)9.5..}..<..Q.@.+8A).+*d8.....:&.B@;....L.....r..r..Z....^i....D|(.08...4.....N..*U+^....r.!............|..@v)8.%..+*.8.4..3:&=.@.1.......].b..r..Z.....v...H.D.(..8.'....L`.NO.*.+^2....rn!.1.....=....|..@.)8.%.H+*$8.....:&..@.1.9..^....bE.r..Zs..p.v+....D<(..8....S.L..N..*.+^...^.r.!...U.....\.|u.@6)8a%.+*.8.....:&..@[1.......b..rN.Z.....v.....D.(.P8......L .N..*u+^....r.!............|..@.)8.%..+*.8.T..S:&].@.1.......}.b..r..Z3..0.v...h.D.(..8.GN"*8L.\.N.N.3
                    C:\Users\user\zT6Nm@i4\111.7z
                    Process:C:\Users\user\zT6Nm@i4\zr.exe
                    File Type:7-zip archive data, version 0.4
                    Category:dropped
                    Size (bytes):895
                    Entropy (8bit):7.58674925006426
                    Encrypted:false
                    SSDEEP:24:7OegEZhc5iZzVT78nOwNDSxEqrohfoiQ3T:KegEZnf8nhmtURo/3T
                    MD5:8B8E701F0984126214856AEA7B49A3E1
                    SHA1:BC4995ABD24C3451D3AF427F7CE03FA484055157
                    SHA-256:D4714CBC4612E14FA5D62B26274411A435396094EFECAAC6D82325FA2400FD04
                    SHA-512:7049B6C1ED94B5F10138C3971598A7C98D2E25F340A3C914F4E0D27074AF70A51FF53A7652CE4373140054B0E16A484D1083483CFEB105F6DF5D313C3FAF35E5
                    Malicious:false
                    Reputation:low
                    Preview: 7z..'...............................l].&.0.!?...o..1b..V..pS.G.U.>............Gg..1>....;....>|*.P..D.H.ta......0ur4..F6..f.d.2..Vzr.....#.%..a...?.6.j8KM..$...Uh..{.{._.21.!....ui8..Y*..M...K.L+.6zE0.....S=..c......4.H...E}..z. D......k...P:3...c9.......7."....V........>..l......R.a.i.Pk.....?*.2.c...,.L.. .VC...ui...y^..[.$..%.ea........B...l-.....w.Ao.0.`.....Z>.......,\>.x...l..d......B.v.#P....a.8V.9`lw.f..J"r.._."9j...r".C.......?.L@..=.....9%...-..4...".[.....I...-...').(Dj.....`0L.Jq.;yZ.!w.i./..\2.e.....iCg...P....xr..9^...*....."..Q...V.V......... 0..M...q.).?uB...H.D..{Q.......[.4C..5....(:.{!\.u}5....*..{..'-..X=T.....3....Ed^.$...p..@.p.u/..........#.,..o.(iAk.HY-.}1./vF...].%...W.z@.@l.......gS........{...*.E.i.n..q.*]Y....H.=<.R.[..V%.!K-}.....v...y.M&..^....T..@....s...AZP.....t..........#....]......r...*....A`.$.......#.........8.
                    C:\Users\user\zT6Nm@i4\KK.txt
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):224323
                    Entropy (8bit):7.996498851977439
                    Encrypted:true
                    SSDEEP:6144:5SDdKtn3KwKa9xg8LIzF9yWeSBvd+tResBuYU:4Dde3xKhOIzOGBF
                    MD5:7B30F5D321E85813F5E5835F92FFA0FC
                    SHA1:369474EA5BFFA01DAC8C663EDE08D7D0D8967054
                    SHA-256:445E5B49DA01A0D99AFD84EF3D9C5238E02D5E4FBC546D43C619005A622C9917
                    SHA-512:8797E96456F2C822DA7B79486784BA49ED7A4CC85FF74F76D097339EA8C2FDC945E1EB51BEF28F7E1358EA38BD6BBB8D1C35D63A54F5000A1D75C5E90DDAB0FD
                    Malicious:false
                    Reputation:low
                    Preview: rc(.%c.Q.q....<cfW.&.-...SP#....|O.%'q5.XrVN\....@J..)F.YZ.....%...,...y.s.x.....C...L.y.'....V.Ck....I.4'L.b....e'.Q..QS...w.xgF...L.Q......../.....'v6=.yj..t.h.n.i.a%g..:#.\.Q.lN...r.ht....y..I..k.ATu/.._..j._B...?%....-..N|.G....|1.V..&..^..8.L..E.y.PQ.....j|fhfm 2....e..k..\. ...Q.......'}u....<.AW".I.a6..Dv.....G.j#..f...^..6.)...ky..yI.X..vv.....v.....*.....$..4...I..........S..Zoz..n).....%....\...TFg...`~.@V.....E.Q....L.._.PnR4OI...^ .Av.y.d.....2.t2...-.D....Y.2.T!.Pl6...@;...[..q.o..'./.3..[k.E :....i.+%....c.@.o......eL....1.cig....?rP.O.C'....Ak...7..R....EG......Q.ey.._.k.r./..TOCe.y......q..<.I:9#+5...^..&.A..........U`v.w..t...A7m.Jg..m..".mz.......#....gW.^...q.z..HbX.......2..iH.!...#H.9..>W....S..&e..k..h<2..c.........b._..0.D1.Bno.q.$bP...*.o8[.Lq.bCG.E3g.W2.^.{.."n.........N4..(.....=E..R..O....|......._L...IX.._.%.....x...`;...]Nm...Q.s7..i..QW.B...h.u.3.~..).#."&..(X.....l0.............X......z...b'..34.
                    C:\Users\user\zT6Nm@i4\K_FPS64.dll
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                    Category:dropped
                    Size (bytes):302592
                    Entropy (8bit):5.94262128533878
                    Encrypted:false
                    SSDEEP:6144:YDVMbwz0W4gWqPcjwhum9o34Ec2x1tRuf+X4zNEP:YDGO0WTWq4wYb34Ec2vupEP
                    MD5:B8477E4DF0F24A96BBAFD2F13C31A4A2
                    SHA1:E4548C10552B1906BBE4A7EED90E97D24C958CF5
                    SHA-256:5EFD269CA1CD474F68ECE50E6AC3F88F1831ACA273DE9789C17DD8A46AEA8D71
                    SHA-512:6FE6FF9E3BD95CE0583AA2BBB06B8AB123363D94AFEEAB3CCE377B1FB5EABB0BA58F1107E822C39FF2D186E788783262EFFAB8270519A2A118C055013BEEC6B3
                    Malicious:true
                    Antivirus:
                    • Antivirus: Virustotal, Detection: 6%, Browse
                    • Antivirus: ReversingLabs, Detection: 10%
                    Reputation:low
                    Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sl..7.@.7.@.7.@.B..6.@...-.0.@...;.,.@.7.A...@.>u...@.>u..=.@.>u..H.@.>u..+.@.>u..6.@.)_..6.@.>u..6.@.Rich7.@.................PE..d......`.........." ................4........................................@......=.....@.........................................@...................x....@..............................................h$..(....................................................text...h........................... ..`.rdata..G...........................@..@.data..............................@....pdata.......@...0..................@..@.tls.........p......................@....rsrc...x...........................@..@.reloc...(.......*...t..............@..B........................................................................................................................................................................................................
                    C:\Users\user\zT6Nm@i4\PMRunner64.exe
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                    Category:dropped
                    Size (bytes):271704
                    Entropy (8bit):5.761811520401724
                    Encrypted:false
                    SSDEEP:3072:wWHyRIh1NDBeEOqDhPbsuB35WlP+7l1MYMb3URvwgwWwBHNFs:nrrNDBeJwhbh3mU9wgw
                    MD5:65DBB57517611D9DE8CE522022DCD727
                    SHA1:B33E6DB5C460E5E38DD636C4D48E9D4523E2838F
                    SHA-256:0525B815E61D3CD83FD4C87032DE7C1DCBA5E8D2619539F925E43624EB6E1D77
                    SHA-512:D8D34BC3642255DFF395CB47A0EA58CC07D911B3535A0A6D972CC4E501F6CCAB200A7D636FCDEE77DC6E7AD6B735918BCDF48EA6F0EA0E26804C31F2D175490D
                    Malicious:true
                    Antivirus:
                    • Antivirus: Virustotal, Detection: 0%, Browse
                    • Antivirus: Metadefender, Detection: 0%, Browse
                    • Antivirus: ReversingLabs, Detection: 0%
                    Reputation:low
                    Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$..eJ.eJ.eJ.....eJ.....+eJ.....eJ.;I.eJ.;O.eJ.;N.eJ.d...eJ.eK.>eJ..;C.eJ..;J.eJ.+;..eJ.e..eJ..;H.eJ.Rich.eJ.........................PE..d....S.^.........."......`..........l0.........@.............................`............`................................................. ...P....... ....`..........X#...P.. ...`...p............................................p..x............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data....*...0......................@....pdata.......`.......&..............@..@.gfids...............<..............@..@.rsrc... ............>..............@..@.reloc.. ....P......................@..B................................................................................................................................................................................
                    C:\Users\user\zT6Nm@i4\TXP\Windows\Start Menu\Programs\Startup\Realtek???????? .lnk
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Jan 14 15:39:10 2021, mtime=Thu Jan 14 15:39:10 2021, atime=Thu Jan 14 15:39:10 2021, length=271704, window=hide
                    Category:dropped
                    Size (bytes):1791
                    Entropy (8bit):3.466273590595946
                    Encrypted:false
                    SSDEEP:24:8Z3AX3ighdUAfmqpdoe7KODlWJdo7aB6m:8Z3AnisOqjl2k0B6
                    MD5:5FF572CBE6B366349A9D3389D4A60CAC
                    SHA1:497C442D14F4A09D00C3294784ECA1DC43A6F4A2
                    SHA-256:16731A0D7B072BE60F580E93797D2E91F2DE970CF45C31EE7B9BAE52D4824B6E
                    SHA-512:6DF6B097BFF0B76EC465A886ABE72EBC7DB3C850E4FA7D8CE1D60A36F57E04E3063507D3F23F059AA7024E7E7162F8F298610AA1702E16217730B1EF79D176B8
                    Malicious:false
                    Reputation:low
                    Preview: L..................F.@.. ....K......K......K.....X%......................,.:..DG..Yr?.D..U..k0.&...&...........-....k.2...X,~.2.......t...CFSF..1.....8R.J7.zT6Nm@i4....t.Y^...H.g.3..(.....gVA.G..k...B......8R.J8R.J....3X.......................z.T.6.N.m.@.i.4...D.j.2.X%...R. .PMRUNN~1.EXE..N.......R..R......W........................P.M.R.u.n.n.e.r.6.4...e.x.e.......U...............-.......T..............w.....C:\Users\user\zT6Nm@i4\PMRunner64.exe........\.....\.....\.....\.....\.P.M.R.u.n.n.e.r.6.4...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.z.T.6.N.m.@.i.4.&.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.z.T.6.N.m.@.i.4.\.P.M.R.u.n.n.e.r.6.4...e.x.e.........%USERPROFILE%\zT6Nm@i4\PMRunner64.exe...............................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.z.T.6.N.m.@.i.4.\.P.M.R.u.n.n.e.r.6.4...e.x.e..........
                    C:\Users\user\zT6Nm@i4\copy.bat
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:ASCII text, with CR, LF line terminators
                    Category:dropped
                    Size (bytes):148
                    Entropy (8bit):4.859584238440697
                    Encrypted:false
                    SSDEEP:3:55Pt+ZIgUAdkdZkRErG+ffbNQdi25Pt+ZIrUhFmRdZkRErG+fUNhn:PwZIPAra3ZQdi2wZIroakn
                    MD5:7EE919ABFE2EBEFCDD420D0E0784F1C9
                    SHA1:760A5A935E7453C7C3D0CFE786975F97931382BB
                    SHA-256:21C285FD608237D8B329AD8266FDCC0E9C671BAEB956E9544CAEC712944EF8A9
                    SHA-512:0327C9A5500BEF65DFF1501553F0471B7CF2584CAA56CBF15673AC4AF10E748C08E15C5878F0C792907F2F777C6393925A22AB36BDBB70C29963FEC9A07AFFF5
                    Malicious:false
                    Reputation:low
                    Preview: copy "C:\Users\user\zT6Nm@i4\zr.exe" "C:\ProgramData\Microsoft\zr.exe"..copy "C:\Users\user\zT6Nm@i4\111.7z" "C:\ProgramData\Microsoft\111.7z"..
                    C:\Users\user\zT6Nm@i4\ru2.url
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:MS Windows 95 Internet shortcut text (URL=<file:///C:\Users\user\zT6Nm@i4\run001.lnk>), ASCII text, with CR line terminators
                    Category:dropped
                    Size (bytes):65
                    Entropy (8bit):4.934228490671524
                    Encrypted:false
                    SSDEEP:3:HRAbABGQVuOt+ZIo7g:HRYF5OwZIig
                    MD5:004A6C48B0C8EE5A854123B30016589A
                    SHA1:E491D660E83A6DC76EDFB00A8750B98E6F66C665
                    SHA-256:2CF3CC8BCD1655AE232418CCFEBBF8D0AA5EFB062F95DF320C27B5C3A69E9A7C
                    SHA-512:02CD3B044426D6CE89CECBFD16D294882AF867C33F53E6AE71104A4D4E2D57C9A551E659616B7D331CD8714E55DED39538796AD4A1F076483E619CF49E864E7E
                    Malicious:false
                    Yara Hits:
                    • Rule: Methodology_Suspicious_Shortcut_Local_URL, Description: Detects local script usage for .URL persistence, Source: C:\Users\user\zT6Nm@i4\ru2.url, Author: @itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)
                    Reputation:low
                    Preview: [InternetShortcut].URL=file:///C:\Users\user\zT6Nm@i4\run001.lnk
                    C:\Users\user\zT6Nm@i4\run.lnk
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Apr 11 22:34:14 2018, mtime=Wed Sep 30 06:35:53 2020, atime=Wed Apr 11 22:34:14 2018, length=273920, window=hide
                    Category:dropped
                    Size (bytes):1845
                    Entropy (8bit):3.204025472281673
                    Encrypted:false
                    SSDEEP:24:8PHjJW6PV7Mmc7S6MAdx+/5+fUt+/g4I0Z57aB6m:8PMYdCXLiu8sIrB6
                    MD5:BE3AF8B163611E11E35121A9C0DE546F
                    SHA1:DFEEE23EAE5794D9C6D7B54A00CB0E42800AFAA3
                    SHA-256:271541E40261A329ED49F004A2ABAAA533009C1E94B9F7CA3CED62756E59912B
                    SHA-512:495C1D2427C943DFBC3739CFC3E104934449E629B39FEF81074F21151345DBA06A96DFE766B03F8CF74CDE5EB8D52CB8F00FA969186E8CECDFCF3B37346739EF
                    Malicious:false
                    Reputation:low
                    Preview: L..................F.@.. ...].......J..S....]...............................5....P.O. .:i.....+00.../C:\...................V.1.....>Qz<..Windows.@......L..8R.J..............................W.i.n.d.o.w.s.....Z.1.....8R.J..System32..B......L..8R.J..........................e...S.y.s.t.e.m.3.2.....V.2......LH. .cmd.exe.@......LH.>Qx<...............t...........&.c.m.d...e.x.e.......J...............-.......I..............w.....C:\Windows\System32\cmd.exe..!.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.c.m.d...e.x.e...C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.&. ./.c. .C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.z.T.6.N.m.@.i.4.\.r.u.n.0.0.1...l.n.k...C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.c.m.d...e.x.e.........%SystemRoot%\System32\cmd.exe.......................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.y
                    C:\Users\user\zT6Nm@i4\run001.lnk
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
                    Category:dropped
                    Size (bytes):1457
                    Entropy (8bit):1.9452446037061828
                    Encrypted:false
                    SSDEEP:12:8zM0i/kdvrHjHbQbfnbB5baP0yZ3ZrwPH:8AIzD7kzzk0yZ3Zk
                    MD5:95A5332A3DE1AE6E16F7E139EE968E9B
                    SHA1:9E7DD05E15FCAC8C1B8E91978B7EFEB923CD6A88
                    SHA-256:5D0904F70763CA9D1118EFD2171BA4A0CF0D7C10B8D121836F95CE16A3E03C5A
                    SHA-512:53A9CA5C5754D742BD568953B8B4A5AB58BDEA9C9CFC7E49C921484883BCF93CA9E5B6758FDFF72FF98BD0C5D1B70B97B264C89912880A7BB179CE26E8A768B0
                    Malicious:false
                    Reputation:low
                    Preview: L..................F.@......................................................A....P.O. .:i.....+00.../C:\...................b.1...........ProgramData.H............................................P.r.o.g.r.a.m.D.a.t.a.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....T.2...........zr.exe..>............................................z.r...e.x.e.......%.....\.....\.....\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.z.r...e.x.e...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.%. .x. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.1.1.1...7.z. .-.y...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.z.r...e.x.e.........%ALLUSERSPROFILE%\Microsoft\zr.exe..................................................................................................................................................................................................................................%.A.L.L.U.S.E.R.S.P.R.O.F.I.L.E.%.\.M.i.c.r.o.s.o.f.t.\.z.r...e.x.e
                    C:\Users\user\zT6Nm@i4\run003.lnk
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Sun Apr 30 07:53:46 2017, mtime=Sun Apr 30 07:53:46 2017, atime=Sun Apr 30 07:53:46 2017, length=461088, window=hide
                    Category:dropped
                    Size (bytes):1837
                    Entropy (8bit):3.401424786774406
                    Encrypted:false
                    SSDEEP:24:8hJ3AX3igX1AnxQfouopHO8jAIM7aB6m:8/3AniRyfouopHdB6
                    MD5:4AC952055902E20C748E96234BF2F56C
                    SHA1:9B0BADF7DE8286543D6D5C45CD19E834E76E671F
                    SHA-256:0D7B6A444BFA014BEE1DC4769FB66663BB1F0FC0B3327EC41AB9F5342BF571EF
                    SHA-512:80639E1E8B2C4DD3BEC66CBEF87B7E1293D9CCE7E8B34C71B9011400E536CBA39801155CAC3C691B096F2B2B55254CF53FB402B7D843E429196C8B5484DD83DA
                    Malicious:false
                    Preview: L..................F.@.. ......i.......i.......i.... .........................:..DG..Yr?.D..U..k0.&...&...........-....k.2...X,~.2.......t...CFSF..1.....8R.J7.zT6Nm@i4....t.Y^...H.g.3..(.....gVA.G..k...B......8R.J8R.J....3X........................z.T.6.N.m.@.i.4...D.T.2. ....J.F .zr.exe..>......J.F.J.F....:X........................z.r...e.x.e.......M...............-.......L..............w.....C:\Users\user\zT6Nm@i4\zr.exe......\.z.r...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.z.T.6.N.m.@.i.4.B.a. .".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.z.T.6.N.m.@.i.4.\.1.1.1...7.z.". .".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.z.T.6.N.m.@.i.4.\.T.X.P.\.*."...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.z.T.6.N.m.@.i.4.\.z.r...e.x.e.........%USERPROFILE%\zT6Nm@i4\zr.exe.......................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.z.T.6.N.m
                    C:\Users\user\zT6Nm@i4\zr.exe
                    Process:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                    Category:dropped
                    Size (bytes):461088
                    Entropy (8bit):6.581027593342649
                    Encrypted:false
                    SSDEEP:12288:tUBwDn0mdLrMkNpj6hTEXRrn9VsArg1xi:tUu7t3GTEhrn9VsA+i
                    MD5:045FCBE6C174AFA9A6A998BDD6F9FAD7
                    SHA1:9F477006DC176608E953EF44902FCE17DDF8FCA3
                    SHA-256:08E510EF41795B4192650452D8E5482DBF71CEFAF9D67CFE02F60253D6023F96
                    SHA-512:59CE53DDA80567A3B3E19FA2FBE404B655CB4203170B1295B1E6C33B9EBD0B6D2526FB568255610E64FA5C29A6F5C464766CDD746E207FFD2D48DA36811D717B
                    Malicious:false
                    Antivirus:
                    • Antivirus: Virustotal, Detection: 0%, Browse
                    • Antivirus: Metadefender, Detection: 0%, Browse
                    • Antivirus: ReversingLabs, Detection: 0%
                    Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................G..............J.......L..G............|.....H........Rich..........................PE..L......W........../..........X....................@..................................W..........................................x.......(............... ............................................................................................text...u........................... ..`.rdata..............................@..@.data...\k..........................@....sxdata......p......................@....rsrc...(...........................@..@........................................................................................................................................................................................................................................................................................
                    \Device\ConDrv
                    Process:C:\ProgramData\Microsoft\zr.exe
                    File Type:ASCII text, with CRLF, CR line terminators
                    Category:dropped
                    Size (bytes):484
                    Entropy (8bit):4.98831110003937
                    Encrypted:false
                    SSDEEP:12:pltQzsBRwgaQH7pyTkaHo8ajFsQcE5+svhJAISLGN2Gy:pYzsDwXQboTjUZH+svhJAI9wv
                    MD5:70C66FCD7F376B7EC9AD79053CA63030
                    SHA1:E3AE64762463879E0B8C91713A291B540131E423
                    SHA-256:3FD565B1794F89DB8FFA179D9EBF283A0AC7B37BD9E8AD8DE94BB1443B0416BA
                    SHA-512:0B07E9206A5B8D60D93AE7AE826605FFBC2DE13B072DB3EEF2A74E0E05485B8ADDA1E5D6231CC9965FD34093739603566841098631FBD89B8F7CC8889A2FBDA0
                    Malicious:false
                    Preview: ..7-Zip (r) [32] 16.04 : Igor Pavlov : Public domain : 2016-10-04....Scanning the drive for archives:.. 0M Scan C:\ProgramData\Microsoft\. .1 file, 871 bytes (1 KiB)....Extracting archive: C:\ProgramData\Microsoft\111.7z..--..Path = C:\ProgramData\Microsoft\111.7z..Type = 7z..Physical Size = 871..Headers Size = 243..Method = LZMA2:12..Solid = -..Blocks = 1.... 0%. .Everything is Ok....Folders: 4..Files: 1..Size: 1791..Compressed: 871..

                    Static File Info

                    General

                    File type:PE32+ executable (GUI) x86-64, for MS Windows
                    Entropy (8bit):6.805779435598225
                    TrID:
                    • Win64 Executable GUI (202006/5) 92.65%
                    • Win64 Executable (generic) (12005/4) 5.51%
                    • Generic Win/DOS Executable (2004/3) 0.92%
                    • DOS Executable Generic (2002/1) 0.92%
                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                    File name:#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    File size:3150336
                    MD5:6665909a2652c5860fd874cb15c3991c
                    SHA1:84a5a2e920e8165634e510766eaa51662401a227
                    SHA256:1ef7ae3509e71c3cd0904a7396831e6bd2c021f14dc5d4b2485a38ebefc3dd3d
                    SHA512:c7ca90037a3e67b443fe6b8f8a8df510eb2794d53a80a416b7234de123703cf5b590f3314f1e0acf749156ce40cc176182d521679c83afceb18b60d39e07c6a5
                    SSDEEP:49152:jwBFRHHY3rC5IgDAI9q8xCFEXlZ40nqSvLcUhGcwKEAX/ivWPlGbjtGysnISnvpZ:jwlHYm5IML9hGvTWlGnUysnISnBdu2
                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c`7...d...d...dFL.d...d.z.d...d.z.d...d.z.d...d...d...d.t.dd..d.t.d...d.t.d...d.t.d...d.t.d...dRich...d................PE..d..

                    File Icon

                    Icon Hash:74cac4d4d4d0c4d4

                    Static PE Info

                    General

                    Entrypoint:0x1401543b0
                    Entrypoint Section:.text
                    Digitally signed:false
                    Imagebase:0x140000000
                    Subsystem:windows gui
                    Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, RELOCS_STRIPPED
                    DLL Characteristics:TERMINAL_SERVER_AWARE, NX_COMPAT
                    Time Stamp:0x600BDCC7 [Sat Jan 23 08:22:31 2021 UTC]
                    TLS Callbacks:
                    CLR (.Net) Version:
                    OS Version Major:5
                    OS Version Minor:2
                    File Version Major:5
                    File Version Minor:2
                    Subsystem Version Major:5
                    Subsystem Version Minor:2
                    Import Hash:5894f7ecf05bebd0f6f297d29b91f916

                    Entrypoint Preview

                    Instruction
                    dec eax
                    sub esp, 28h
                    call 00007F7DAC8515DCh
                    dec eax
                    add esp, 28h
                    jmp 00007F7DAC84AA97h
                    int3
                    int3
                    dec eax
                    mov dword ptr [esp+08h], ebx
                    push edi
                    dec eax
                    sub esp, 20h
                    dec eax
                    lea eax, dword ptr [00076193h]
                    mov ebx, edx
                    dec eax
                    mov edi, ecx
                    dec eax
                    mov dword ptr [ecx], eax
                    call 00007F7DAC851667h
                    test bl, 00000001h
                    je 00007F7DAC84AC4Ah
                    dec eax
                    mov ecx, edi
                    call 00007F7DAC6F960Eh
                    dec eax
                    mov eax, edi
                    dec eax
                    mov ebx, dword ptr [esp+30h]
                    dec eax
                    add esp, 20h
                    pop edi
                    ret
                    int3
                    int3
                    int3
                    dec eax
                    sub esp, 28h
                    dec eax
                    mov eax, edx
                    dec eax
                    lea edx, dword ptr [ecx+11h]
                    dec eax
                    lea ecx, dword ptr [eax+11h]
                    call 00007F7DAC8516B1h
                    test eax, eax
                    sete al
                    dec eax
                    add esp, 28h
                    ret
                    int3
                    int3
                    dec eax
                    mov dword ptr [esp+10h], ebx
                    dec eax
                    mov dword ptr [esp+18h], ebp
                    dec eax
                    mov dword ptr [esp+20h], esi
                    push edi
                    inc ecx
                    push esp
                    inc ecx
                    push ebp
                    inc ecx
                    push esi
                    inc ecx
                    push edi
                    dec eax
                    sub esp, 20h
                    dec ecx
                    arpl word ptr [eax+0Ch], di
                    dec esp
                    mov edi, ecx
                    dec ecx
                    mov ecx, eax
                    dec ecx
                    mov ebp, ecx
                    dec ebp
                    mov ebp, eax
                    dec esp
                    mov esi, edx
                    call 00007F7DAC8517ADh
                    dec ebp
                    mov edx, dword ptr [edi]
                    dec esp
                    mov dword ptr [ebp+00h], edx
                    inc esp
                    mov esp, eax
                    test edi, edi
                    je 00007F7DAC84ACCAh
                    dec eax
                    lea ecx, dword ptr [edi+edi*4]
                    dec eax
                    lea esi, dword ptr [FFFFFFECh+ecx*4]
                    dec ecx
                    arpl word ptr [ebp+10h], bx
                    dec ecx

                    Rich Headers

                    Programming Language:
                    • [ C ] VS2008 SP1 build 30729
                    • [ASM] VS2010 build 30319
                    • [ C ] VS2010 build 30319
                    • [C++] VS2010 build 30319
                    • [RES] VS2010 build 30319
                    • [IMP] VS2008 SP1 build 30729
                    • [LNK] VS2010 build 30319

                    Data Directories

                    NameVirtual AddressVirtual Size Is in Section
                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_IMPORT0x1ff9380x17c.rdata
                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x3060000xb0f8.rsrc
                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x2f00000x13518.pdata
                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_IAT0x17b0000x1350.rdata
                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                    Sections

                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                    .text0x10000x179a480x179c00False0.519473729112data6.37063911403IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                    .rdata0x17b0000x886cc0x88800False0.253088870765data4.38109791814IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    .data0x2040000xeb2900xdee00False0.944429595485data7.74292213666IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                    .pdata0x2f00000x135180x13600False0.497505040323data6.14754754116IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    text0x3040000xbbd0xc00False0.466796875data5.50929008744IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA
                    data0x3050000x7600x800False0.6806640625data5.89712002279IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    .rsrc0x3060000xb0f80xb200False0.413031074438data5.68750375192IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                    Resources

                    NameRVASizeTypeLanguageCountry
                    RT_CURSOR0x306c100x134dataChineseChina
                    RT_CURSOR0x306d440xb4dataChineseChina
                    RT_CURSOR0x306df80x134AmigaOS bitmap fontChineseChina
                    RT_CURSOR0x306f2c0x134dataChineseChina
                    RT_CURSOR0x3070600x134dataChineseChina
                    RT_CURSOR0x3071940x134dataChineseChina
                    RT_CURSOR0x3072c80x134dataChineseChina
                    RT_CURSOR0x3073fc0x134dataChineseChina
                    RT_CURSOR0x3075300x134dataChineseChina
                    RT_CURSOR0x3076640x134dataChineseChina
                    RT_CURSOR0x3077980x134dataChineseChina
                    RT_CURSOR0x3078cc0x134dataChineseChina
                    RT_CURSOR0x307a000x134AmigaOS bitmap fontChineseChina
                    RT_CURSOR0x307b340x134dataChineseChina
                    RT_CURSOR0x307c680x134dataChineseChina
                    RT_CURSOR0x307d9c0x134dataChineseChina
                    RT_BITMAP0x307ed00xb8dataChineseChina
                    RT_BITMAP0x307f880x144dataChineseChina
                    RT_ICON0x3080cc0xea8dataChineseChina
                    RT_ICON0x308f740x8a8dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0ChineseChina
                    RT_ICON0x30981c0x568GLS_BINARY_LSB_FIRSTChineseChina
                    RT_ICON0x309d840x25adPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedChineseChina
                    RT_ICON0x30c3340x25a8dataChineseChina
                    RT_ICON0x30e8dc0x10a8dataChineseChina
                    RT_ICON0x30f9840x468GLS_BINARY_LSB_FIRSTChineseChina
                    RT_DIALOG0x30fdec0xdedataChineseChina
                    RT_DIALOG0x30fecc0x210dataChineseChina
                    RT_DIALOG0x3100dc0xe2dataChineseChina
                    RT_DIALOG0x3101c00x34dataChineseChina
                    RT_STRING0x3101f40x6adataChineseChina
                    RT_STRING0x3102600x4edataChineseChina
                    RT_STRING0x3102b00x2cdataChineseChina
                    RT_STRING0x3102dc0x84dataChineseChina
                    RT_STRING0x3103600x1c4dataChineseChina
                    RT_STRING0x3105240x14edataChineseChina
                    RT_STRING0x3106740x10edataChineseChina
                    RT_STRING0x3107840x50dataChineseChina
                    RT_STRING0x3107d40x44dataChineseChina
                    RT_STRING0x3108180x68dataChineseChina
                    RT_STRING0x3108800x1b2dataChineseChina
                    RT_STRING0x310a340xf4dataChineseChina
                    RT_STRING0x310b280x24dataChineseChina
                    RT_STRING0x310b4c0x1a6dataChineseChina
                    RT_GROUP_CURSOR0x310cf40x22Lotus unknown worksheet or configuration, revision 0x2ChineseChina
                    RT_GROUP_CURSOR0x310d180x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310d2c0x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310d400x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310d540x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310d680x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310d7c0x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310d900x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310da40x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310db80x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310dcc0x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310de00x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310df40x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310e080x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_CURSOR0x310e1c0x14Lotus unknown worksheet or configuration, revision 0x1ChineseChina
                    RT_GROUP_ICON0x310e300x68dataChineseChina
                    RT_MANIFEST0x310e980x25fASCII text, with very long lines, with no line terminatorsEnglishUnited States

                    Imports

                    DLLImport
                    KERNEL32.dllIsValidCodePage, GetTimeZoneInformation, LCMapStringW, GetConsoleCP, GetConsoleMode, WriteConsoleW, SetEnvironmentVariableA, RtlCaptureContext, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, HeapCreate, GetVersion, HeapSetInformation, FlsAlloc, FlsFree, FlsSetValue, FlsGetValue, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStdHandle, SizeofResource, SetUnhandledExceptionFilter, GetFileType, SetStdHandle, VirtualQuery, GetSystemInfo, SetThreadStackGuarantee, HeapSize, HeapQueryInformation, RtlPcToFileHeader, GetOEMCP, CreateThread, ExitThread, HeapReAlloc, GetSystemTimeAsFileTime, DecodePointer, EncodePointer, RtlUnwindEx, RtlLookupFunctionEntry, GetStartupInfoW, GetCommandLineW, FindResourceExW, SearchPathW, Sleep, GetProfileIntW, InitializeCriticalSectionAndSpinCount, GetTickCount, GetNumberFormatW, GetWindowsDirectoryW, GetTempPathW, GetTempFileNameW, GetFileTime, GetFileSizeEx, GetFileAttributesW, FileTimeToLocalFileTime, GetFileAttributesExW, SetErrorMode, FileTimeToSystemTime, GlobalGetAtomNameW, lstrlenA, GetFullPathNameW, GetACP, GetCPInfo, RaiseException, GetStringTypeW, GetVolumeInformationW, FindFirstFileW, FindClose, GetCurrentProcess, DuplicateHandle, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, CreateFileW, lstrcmpiW, GetThreadLocale, lstrcpyW, DeleteFileW, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, GlobalHandle, GlobalReAlloc, TlsAlloc, InitializeCriticalSection, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GlobalFlags, GetCurrentDirectoryW, ReleaseActCtx, CreateActCtxW, CopyFileW, GlobalSize, FormatMessageW, LocalFree, MulDiv, GlobalFindAtomW, GetVersionExW, CompareStringW, GlobalUnlock, GlobalFree, FreeResource, GetCurrentProcessId, GlobalAddAtomW, GetPrivateProfileStringW, lstrlenW, WritePrivateProfileStringW, GetPrivateProfileIntW, CreateEventW, SuspendThread, SetEvent, WaitForSingleObject, ResumeThread, SetThreadPriority, CloseHandle, lstrcmpA, GlobalDeleteAtom, GetCurrentThread, GetCurrentThreadId, GetUserDefaultUILanguage, ConvertDefaultLocale, GetSystemDefaultUILanguage, GetModuleFileNameW, GetLocaleInfoW, ActivateActCtx, LoadLibraryW, GetLastError, DeactivateActCtx, SetLastError, WideCharToMultiByte, GlobalLock, lstrcmpW, GlobalAlloc, GetModuleHandleW, HeapAlloc, FreeLibrary, GetProcessHeap, HeapFree, IsBadReadPtr, LoadLibraryA, GetProcAddress, VirtualFree, VirtualProtect, VirtualAlloc, MultiByteToWideChar, TerminateThread, ExitProcess, FindResourceW, LoadResource, LockResource
                    USER32.dllSetMenuDefaultItem, PostThreadMessageW, CreateMenu, IsMenu, UpdateLayeredWindow, UnionRect, MonitorFromPoint, TranslateMDISysAccel, DrawMenuBar, DefMDIChildProcW, DefFrameProcW, RegisterClipboardFormatW, CopyImage, GetIconInfo, EnableScrollBar, HideCaret, InvertRect, GetMenuDefaultItem, UnpackDDElParam, ReuseDDElParam, LoadImageW, InsertMenuItemW, TranslateAcceleratorW, LockWindowUpdate, BringWindowToTop, SetCursorPos, CreateAcceleratorTableW, LoadAcceleratorsW, GetKeyboardState, GetKeyboardLayout, ToUnicodeEx, DrawFocusRect, DrawFrameControl, DrawEdge, DrawIconEx, DrawStateW, SetClassLongPtrW, GetAsyncKeyState, NotifyWinEvent, CreatePopupMenu, DestroyAcceleratorTable, SetParent, RedrawWindow, SetWindowRgn, IsZoomed, UnregisterClassW, MessageBeep, GetNextDlgGroupItem, InvalidateRgn, SetRect, IsRectEmpty, CopyAcceleratorTableW, OffsetRect, CharNextW, IntersectRect, LoadMenuW, CharUpperW, DestroyIcon, WaitMessage, ReleaseCapture, WindowFromPoint, SetCapture, GetSysColorBrush, LoadCursorW, SetLayeredWindowAttributes, SetRectEmpty, KillTimer, SetTimer, InvalidateRect, RealChildWindowFromPoint, DeleteMenu, EndPaint, BeginPaint, GetWindowDC, ClientToScreen, GrayStringW, DrawTextExW, DrawTextW, TabbedTextOutW, FillRect, SystemParametersInfoW, DestroyMenu, IsClipboardFormatAvailable, InflateRect, GetMenuStringW, InsertMenuW, RemoveMenu, ShowWindow, SetWindowTextW, IsDialogMessageW, SetDlgItemTextW, CheckDlgButton, RegisterWindowMessageW, SendDlgItemMessageW, SendDlgItemMessageA, WinHelpW, IsChild, GetCapture, GetClassNameW, GetClassLongPtrW, SetPropW, GetPropW, RemovePropW, SetFocus, GetWindowTextLengthW, GetWindowTextW, GetForegroundWindow, BeginDeferWindowPos, EndDeferWindowPos, GetTopWindow, GetWindowLongPtrW, SetWindowLongPtrW, UnhookWindowsHookEx, GetMessageTime, GetMessagePos, MonitorFromWindow, GetMonitorInfoW, MapWindowPoints, ScrollWindow, TrackPopupMenu, SetMenu, SetScrollRange, GetScrollRange, SetScrollPos, GetScrollPos, SetForegroundWindow, ShowScrollBar, UpdateWindow, GetSubMenu, GetMenuItemID, GetMenuItemCount, CreateWindowExW, GetClassInfoExW, GetClassInfoW, RegisterClassW, GetSysColor, AdjustWindowRectEx, GetWindowRect, ScreenToClient, EqualRect, DeferWindowPos, GetScrollInfo, SetScrollInfo, PtInRect, SetWindowPlacement, GetWindowPlacement, GetDlgCtrlID, DefWindowProcW, CallWindowProcW, GetMenu, GetWindow, SetWindowContextHelpId, FrameRect, GetUpdateRect, GetWindowRgn, DestroyCursor, SubtractRect, MapVirtualKeyExW, IsCharLowerW, GetDoubleClickTime, MapDialogRect, SetWindowPos, MapVirtualKeyW, GetKeyNameTextW, ReleaseDC, GetDC, CopyRect, GetDesktopWindow, SetActiveWindow, CreateDialogIndirectParamW, CharUpperBuffW, CopyIcon, EmptyClipboard, CloseClipboard, SetClipboardData, GetMenuItemInfoW, OpenClipboard, DestroyWindow, IsWindow, GetDlgItem, GetNextDlgTabItem, EndDialog, GetWindowThreadProcessId, GetLastActivePopup, IsWindowEnabled, MessageBoxW, ShowOwnedPopups, SetCursor, SetWindowsHookExW, CallNextHookEx, GetMessageW, TranslateMessage, DispatchMessageW, GetActiveWindow, IsWindowVisible, GetKeyState, PeekMessageW, GetCursorPos, ValidateRect, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapW, GetFocus, GetParent, ModifyMenuW, GetMenuState, EnableMenuItem, CheckMenuItem, PostMessageW, PostQuitMessage, GetSystemMetrics, LoadIconW, EnableWindow, GetClientRect, IsIconic, GetSystemMenu, SendMessageW, AppendMenuW, DrawIcon, MoveWindow, GetWindowLongW, SetWindowLongW, EnumDisplayMonitors
                    GDI32.dllCreateSolidBrush, CreateHatchBrush, CreateDIBitmap, CreateCompatibleBitmap, GetTextMetricsW, EnumFontFamiliesW, GetTextCharsetInfo, SetRectRgn, CombineRgn, GetMapMode, DPtoLP, GetBkColor, GetTextColor, GetRgnBox, CreateDIBSection, CreateRoundRectRgn, CreatePolygonRgn, CreateEllipticRgn, Polyline, Ellipse, Polygon, CreatePalette, GetPaletteEntries, GetNearestPaletteIndex, RealizePalette, GetSystemPaletteEntries, OffsetRgn, SetDIBColorTable, CreatePen, SetPixel, Rectangle, EnumFontFamiliesExW, LPtoDP, GetWindowOrgEx, GetViewportOrgEx, PtInRegion, FillRgn, FrameRgn, GetBoundsRect, ExtFloodFill, SetPaletteEntries, GetTextFaceW, SetPixelV, RectVisible, PtVisible, GetPixel, GetObjectType, TextOutW, SelectPalette, GetStockObject, CreatePatternBrush, DeleteDC, ExtSelectClipRgn, ScaleWindowExtEx, SetWindowExtEx, OffsetWindowOrgEx, SetWindowOrgEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SelectObject, StretchBlt, CreateBitmap, GetWindowExtEx, GetViewportExtEx, CreateRectRgn, SelectClipRgn, DeleteObject, SetLayout, GetLayout, SetTextAlign, MoveToEx, LineTo, IntersectClipRect, ExcludeClipRect, GetClipBox, SetMapMode, SetROP2, SetPolyFillMode, SetBkMode, RestoreDC, SaveDC, GetTextExtentPoint32W, ExtTextOutW, BitBlt, CreateCompatibleDC, CreateFontIndirectW, CreateDCW, CopyMetaFileW, GetDeviceCaps, GetObjectW, SetBkColor, SetTextColor, PatBlt, CreateRectRgnIndirect, Escape
                    MSIMG32.dllAlphaBlend, TransparentBlt
                    COMDLG32.dllGetFileTitleW
                    WINSPOOL.DRVClosePrinter, OpenPrinterW, DocumentPropertiesW
                    ADVAPI32.dllRegEnumKeyExW, RegQueryValueExW, RegOpenKeyExW, RegCreateKeyExW, RegSetValueExW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyW, RegQueryValueW, RegCloseKey, RegEnumValueW
                    SHELL32.dllSHAppBarMessage, SHGetFileInfoW, ShellExecuteW, DragFinish, DragQueryFileW, SHBrowseForFolderW, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetDesktopFolder
                    COMCTL32.dllImageList_GetIconSize
                    SHLWAPI.dllPathFindFileNameW, PathStripToRootW, PathIsUNCW, PathFindExtensionW, PathRemoveFileSpecW
                    ole32.dllOleInitialize, CoFreeUnusedLibraries, OleUninitialize, CoInitializeEx, CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, CoInitialize, CoUninitialize, OleCreateMenuDescriptor, CoTaskMemAlloc, ReleaseStgMedium, CoTaskMemFree, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleLockRunning, CreateStreamOnHGlobal, OleIsCurrentClipboard, OleFlushClipboard, DoDragDrop, CLSIDFromString, CLSIDFromProgID, CoCreateGuid, RevokeDragDrop, CoLockObjectExternal, RegisterDragDrop, OleGetClipboard, OleDuplicateData, CoRegisterMessageFilter, CoCreateInstance, CoRevokeClassObject
                    OLEAUT32.dllSysFreeString, VarBstrFromDate, VariantCopy, SafeArrayDestroy, SystemTimeToVariantTime, VariantTimeToSystemTime, OleCreateFontIndirect, SysStringLen, VariantInit, VariantChangeType, VariantClear, SysAllocStringLen, SysAllocString
                    oledlg.dllOleUIBusyW
                    WS2_32.dllWSAIoctl, htons, inet_ntoa, gethostbyname, gethostname, WSASocketW, WSAStartup, ntohs, recv, bind
                    OLEACC.dllLresultFromObject, AccessibleObjectFromWindow, CreateStdAccessibleObject
                    gdiplus.dllGdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipCloneImage, GdipDrawImageRectI, GdipSetInterpolationMode, GdipGetImagePaletteSize, GdiplusShutdown, GdiplusStartup, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipDeleteGraphics, GdipAlloc, GdipFree, GdipGetImagePalette, GdipCreateBitmapFromStream, GdipCreateBitmapFromScan0, GdipBitmapLockBits, GdipBitmapUnlockBits, GdipGetImageGraphicsContext, GdipCreateFromHDC, GdipDrawImageI
                    IMM32.dllImmGetOpenStatus, ImmReleaseContext, ImmGetContext
                    WINMM.dllPlaySoundW

                    Possible Origin

                    Language of compilation systemCountry where language is spokenMap
                    ChineseChina
                    EnglishUnited States

                    Network Behavior

                    Network Port Distribution

                    TCP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Jan 24, 2021 10:23:23.492737055 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.493050098 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.493232012 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.493341923 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.493448019 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.493484020 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.493712902 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.493824005 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.493865967 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.503756046 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.503794909 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.503830910 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.503869057 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.503894091 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.503979921 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.504018068 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.504620075 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.504646063 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.504668951 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.504837036 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.504875898 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.505203962 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.505242109 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.505482912 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.505522966 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.505681992 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.505717039 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.505799055 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.505855083 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:23.506150961 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.506251097 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.506513119 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.506541967 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.626178026 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:23.626334906 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.676939011 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677278996 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677455902 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677529097 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677571058 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677608013 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677635908 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677711964 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677747011 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677762985 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.677767992 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.686454058 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.686647892 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.686887026 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.687319994 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.687814951 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.687844992 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.687937021 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.688262939 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.688580036 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.688678026 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.688756943 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.688922882 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.689089060 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.689160109 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.689368963 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.689434052 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.689743042 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.689924002 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.720083952 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.720293045 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:28.755439043 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:23:28.755672932 CET49696443192.168.2.4204.79.197.200
                    Jan 24, 2021 10:23:37.462538004 CET49683443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.462593079 CET49682443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.462704897 CET49683443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.462745905 CET49682443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.499459982 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.499675989 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.499989986 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.500017881 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.553977013 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.554744005 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645104885 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645154953 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645194054 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645241976 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645297050 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645302057 CET49682443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.645345926 CET49682443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.645354986 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645435095 CET49682443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.645481110 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645541906 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645591974 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645615101 CET49682443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.645648003 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645689964 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645725965 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645764112 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645801067 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645807028 CET49683443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.645837069 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645838022 CET49683443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.645874023 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645915031 CET49683443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.645931005 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.645987034 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:23:37.646002054 CET49683443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.686861992 CET49683443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:37.697947025 CET49682443192.168.2.440.126.31.135
                    Jan 24, 2021 10:23:44.404624939 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:44.628895998 CET1352749744110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:44.629020929 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:44.673149109 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:44.892343998 CET1352749744110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:44.932837963 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:45.670763016 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:45.893397093 CET1352749744110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:45.948796988 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:49.980010986 CET1352749744110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:49.994618893 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:50.026993036 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:50.186917067 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:50.187036037 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:50.193909883 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:50.387290955 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:50.411216974 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:50.610318899 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:50.652071953 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:50.759540081 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:50.963913918 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:50.963973999 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:50.964061022 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:50.964103937 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:50.964139938 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:50.964200974 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.156513929 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.156574011 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.156611919 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.156658888 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.156680107 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.156770945 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.156811953 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.156830072 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.156867981 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.156903982 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.156936884 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.157119989 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.349153042 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349229097 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349268913 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349322081 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349366903 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349406958 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.349477053 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349519968 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349538088 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.349575996 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.349631071 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349673986 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349726915 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.349766970 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349803925 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349841118 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349877119 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349896908 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.349946022 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.349986076 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.350016117 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.350043058 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.350085974 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.350173950 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.542428017 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542546988 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542587996 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542634964 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542674065 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542704105 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.542759895 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542800903 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542840004 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.542848110 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.542865038 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542913914 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542951107 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.542988062 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543021917 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.543028116 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.543055058 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543097973 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543144941 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543188095 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543222904 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.543231010 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.543251991 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543289900 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543327093 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543365002 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543396950 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.543402910 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.543423891 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543462038 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543500900 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543540001 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543574095 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.543585062 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.543644905 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543694019 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.543729067 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.544234037 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.545517921 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.789244890 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.994138002 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994185925 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994221926 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994277954 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994292021 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.994347095 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994389057 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994426966 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994462013 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994478941 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.994518995 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994558096 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994613886 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994626999 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.994636059 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.994688988 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994756937 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994805098 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994833946 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.994873047 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994910955 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.994950056 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.994997978 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995035887 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.995060921 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995099068 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995135069 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995170116 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995208979 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995225906 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.995270014 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995282888 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.995316982 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995352030 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995398045 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995440006 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995476961 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995517969 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995568037 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.995575905 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.995587111 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995625973 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995659113 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995697021 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995733023 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995779037 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995820045 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995839119 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.995846033 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.995883942 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995920897 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995956898 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.995990038 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996009111 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.996016026 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.996048927 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996084929 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996121883 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996159077 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996175051 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.996186018 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.996227980 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996268034 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996304989 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996336937 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996356964 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.996364117 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.996397018 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996433973 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996469975 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:51.996522903 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:51.996534109 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.188680887 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.188730001 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.188767910 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.188790083 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.188832998 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.188877106 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.188992023 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.230405092 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.778477907 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.979238987 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979288101 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979325056 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979362011 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.979389906 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979429960 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979448080 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.979487896 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979523897 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979542971 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.979597092 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979652882 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979665041 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.979716063 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979763031 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979773998 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.979813099 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979849100 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979871035 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.979918003 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979973078 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.979986906 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980030060 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980077982 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980089903 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980128050 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980164051 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980180025 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980217934 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980254889 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980271101 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980309010 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980345964 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980376959 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980392933 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980436087 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980458975 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980506897 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980556011 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980566978 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980606079 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980648994 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980659962 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980698109 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980746984 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980757952 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980792046 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980834007 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980844975 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980882883 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980923891 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.980936050 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.980983973 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.981025934 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:52.981041908 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.981071949 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:52.981113911 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:53.118199110 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:53.365730047 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:53.814583063 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:53.814702988 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:53.859205008 CET4974513527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:54.051073074 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:54.051347017 CET1352749745110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:54.270224094 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:54.270334005 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:54.288530111 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:54.507450104 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:54.574243069 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:54.612688065 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:54.836000919 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:54.886840105 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:55.295989037 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:55.307897091 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:55.515795946 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.515813112 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.515820980 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.515970945 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:55.516011953 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:55.526813030 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.526993990 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:55.735239983 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.735272884 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.735299110 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.735323906 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.735451937 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:55.745811939 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.745851994 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.954360008 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.954396009 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.954477072 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:55.954575062 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:55.954715014 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:56.223587990 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:56.223792076 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:56.491796970 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:56.491944075 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:56.761743069 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:56.761857033 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:57.030440092 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:57.030524969 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:57.300798893 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:57.300970078 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:57.570388079 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:57.571827888 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:57.698775053 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:57.840342045 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:57.917685032 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:57.917718887 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:57.917814970 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:57.993100882 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:58.214649916 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:58.214685917 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:58.215725899 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:58.484622002 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:58.486310959 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:58.755295992 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:58.755490065 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:59.024013996 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:59.024091959 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:59.292634964 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:59.296293020 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:59.564798117 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:59.564878941 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:23:59.833225012 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:23:59.836514950 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:00.106441021 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:00.108120918 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:00.376741886 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:00.376991987 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:00.645517111 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:00.645638943 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:00.914259911 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:00.914372921 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:01.182372093 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:01.182488918 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:01.451486111 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:01.451598883 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:01.720177889 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:01.720314980 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:01.988185883 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:01.988405943 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:02.258222103 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:02.258667946 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:02.527736902 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:02.527841091 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:02.796634912 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:02.798907995 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:03.067519903 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:03.067601919 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:03.336163044 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:03.336451054 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:03.482877970 CET804968893.184.220.29192.168.2.4
                    Jan 24, 2021 10:24:03.483721018 CET4968880192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:03.597266912 CET804968793.184.220.29192.168.2.4
                    Jan 24, 2021 10:24:03.598772049 CET4968780192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:03.605046034 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:03.605139017 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:03.873642921 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:03.876305103 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:04.144437075 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:04.144527912 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:04.188651085 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:04.406955004 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:04.407644987 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:04.452977896 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:04.577502966 CET804971193.184.220.29192.168.2.4
                    Jan 24, 2021 10:24:04.577620983 CET4971180192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:04.626560926 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:04.715922117 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:04.757339001 CET804971293.184.220.29192.168.2.4
                    Jan 24, 2021 10:24:04.759186983 CET4971280192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:04.984618902 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:04.984940052 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:05.253281116 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:05.255887032 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:05.271456957 CET49713443192.168.2.4104.79.89.181
                    Jan 24, 2021 10:24:05.271657944 CET4971480192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:05.524389982 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:05.524590015 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:05.753616095 CET804970793.184.220.29192.168.2.4
                    Jan 24, 2021 10:24:05.753742933 CET4970780192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:05.792771101 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:05.793199062 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:06.062020063 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:06.062305927 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:06.330858946 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:06.330975056 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:06.609314919 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:06.609409094 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:06.877954006 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:06.878751993 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:07.146608114 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:07.147188902 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:07.415678024 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:07.415781021 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:07.685522079 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:07.685849905 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:07.954140902 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:07.954351902 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:08.223099947 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:08.223467112 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:08.492399931 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:08.494678020 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:08.763119936 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:08.763338089 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:09.031897068 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:09.031997919 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:09.300657034 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:09.301146984 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:09.570686102 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:09.570786953 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:09.838772058 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:09.839318037 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:10.108814001 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:10.402307034 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:10.670810938 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:10.672283888 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:10.940509081 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:11.392703056 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:11.661114931 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:11.661201954 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:11.930252075 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:11.930355072 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:12.199026108 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:12.199130058 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:12.467624903 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:12.467708111 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:12.735907078 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:12.736166000 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:13.004185915 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:13.005191088 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:13.274581909 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:13.278134108 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:13.546989918 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:13.547348976 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:13.816880941 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:13.817001104 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:14.087378025 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:14.087476015 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:14.363312960 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:14.365601063 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:14.634673119 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:14.634782076 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:14.904660940 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:14.904779911 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:15.172898054 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:15.172988892 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:15.441334963 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:15.441540956 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:15.711215973 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:15.711436987 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:15.989732027 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:15.990199089 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:16.258379936 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:16.258465052 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:16.527291059 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:16.527455091 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:16.566608906 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:16.798059940 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:16.800570965 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:16.838176966 CET1352749744110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:17.069073915 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:17.069190979 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:17.337997913 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:17.338148117 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:17.606755018 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:17.607089996 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:17.876199007 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:17.877790928 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:18.146377087 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:18.146477938 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:18.414860010 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:18.416063070 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:18.684304953 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:18.685837984 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:18.954674006 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:18.956798077 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:19.225153923 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:19.225323915 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:19.494291067 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:19.497940063 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:19.766884089 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:19.767023087 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:20.036458969 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:20.036592007 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:20.304441929 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:20.304681063 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:20.574187994 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:20.574295998 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:20.842816114 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:20.843712091 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:21.112056971 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:21.113923073 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:21.382647038 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:21.382750988 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:21.651397943 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:21.651499033 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:21.929666996 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:21.929831028 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:22.198828936 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:22.200498104 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:22.468805075 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:22.470222950 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:22.738514900 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:22.738609076 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:23.007834911 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:23.008702993 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:23.277044058 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:23.277196884 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:23.546056032 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:23.546264887 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:23.815642118 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:23.815763950 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:24.084367037 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:24.084583044 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:24.352526903 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:24.353346109 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:24.622344017 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:24.623051882 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:24.891127110 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:24.892421961 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:25.161118031 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:25.161360025 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:25.440212011 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:25.442578077 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:25.710808039 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:25.713737011 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:25.805048943 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:25.903383017 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:25.982023001 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:26.023891926 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:26.035103083 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:26.123476982 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:26.143909931 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:26.254165888 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:26.254245996 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:26.362951040 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:26.364584923 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:26.523013115 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:26.526617050 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:26.633141041 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:26.634171009 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:26.793479919 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:26.904495955 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:26.906682968 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:27.175882101 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:27.178646088 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:27.447189093 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:27.450264931 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:27.718775034 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:27.893541098 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:28.162134886 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:28.162406921 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:28.431360960 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:28.664343119 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:28.933193922 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:28.933428049 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:29.203636885 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:29.203773022 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:29.471947908 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:29.472130060 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:29.740379095 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:29.740506887 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:30.009432077 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:30.009541988 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:30.279051065 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:30.279210091 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:30.548115969 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:30.548228979 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:30.816816092 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:30.817253113 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:31.086479902 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:31.086667061 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:31.355819941 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:31.355921984 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:31.625742912 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:31.625927925 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:31.894752026 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:31.895200968 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:32.163626909 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:32.163947105 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:32.434046030 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:32.434236050 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:32.702395916 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:32.705086946 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:32.973676920 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:32.973814011 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:33.244616032 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:33.244744062 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:33.513820887 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:33.513923883 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:33.783210039 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:33.783324003 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:34.051631927 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:34.051717997 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:34.329853058 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:34.333246946 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:34.602957964 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:34.603135109 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:34.871273994 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:34.874190092 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:35.143079042 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:35.143322945 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:35.412717104 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:35.414908886 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:35.683578968 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:35.687561989 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:35.956814051 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:35.959089041 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:36.228622913 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:36.228730917 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:36.496671915 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:36.496763945 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:36.764910936 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:36.767513990 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:37.036355019 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:37.039608002 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:37.308146000 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:37.311693907 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:37.589992046 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:37.590531111 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:37.858679056 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:37.858841896 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:38.127378941 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:38.127494097 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:38.395629883 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:38.395757914 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:38.664344072 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:38.664644957 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:38.933423042 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:38.933621883 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:39.203843117 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:39.203955889 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:39.472434044 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:39.472563028 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:39.741750002 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:39.743758917 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:40.012676954 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:40.012800932 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:40.281017065 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:40.281892061 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:40.559911966 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:40.561508894 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:40.830530882 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:40.834180117 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:41.102693081 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:41.107939005 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:41.376296043 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:41.376650095 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:41.645350933 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:41.647895098 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:41.916986942 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:41.917927027 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:42.186188936 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:42.186285973 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:42.455260038 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:42.456051111 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:42.724718094 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:42.725914955 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:42.994393110 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:42.994574070 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:43.262664080 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:43.262840033 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:43.531454086 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:43.531548023 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:43.800040960 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:43.800143957 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:44.069000959 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:44.072150946 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:44.340634108 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:44.344223022 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:44.612821102 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:44.612912893 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:44.883492947 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:44.884325027 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:45.154580116 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:45.156296015 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:45.426048994 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:45.428379059 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:45.696516037 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:45.700423002 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:45.969198942 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:46.025207996 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:46.293617964 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:46.293797970 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:46.562621117 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:46.562864065 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:46.832654953 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:46.832895994 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:47.103919983 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:47.104196072 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:47.373049021 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:47.530911922 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:47.799447060 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:47.799551010 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:48.067898035 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:48.068078041 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:48.336503983 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:48.336639881 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:48.563296080 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:48.604945898 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:48.605097055 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:48.832588911 CET1352749744110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:48.871464014 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:48.871565104 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:49.140199900 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:49.140345097 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:49.408720016 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:49.408828020 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:49.491842031 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:49.589169979 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:49.668848991 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:49.677587032 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:49.710947037 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:49.808396101 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:49.808531046 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:49.887806892 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:49.887897968 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:50.076951981 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:50.077136040 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:50.155924082 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:50.156117916 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:50.346848965 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:50.346959114 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:50.426770926 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:50.426847935 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:50.615374088 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:50.615545988 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:50.698685884 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:50.698919058 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:50.884274960 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:50.884433031 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:50.968293905 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:50.968377113 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:51.153485060 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:51.153713942 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:51.233433962 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:51.233550072 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:51.423113108 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:51.423212051 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:51.502192020 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:51.502307892 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:51.692327976 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:51.692431927 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:51.780338049 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:51.780431032 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:51.970549107 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:51.970638990 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:52.051393986 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:52.051599026 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:52.188894987 CET49681443192.168.2.440.126.31.135
                    Jan 24, 2021 10:24:52.188981056 CET4968880192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:52.189145088 CET4968780192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:52.189455986 CET49682443192.168.2.440.126.31.135
                    Jan 24, 2021 10:24:52.189517975 CET49683443192.168.2.440.126.31.135
                    Jan 24, 2021 10:24:52.208045959 CET804968793.184.220.29192.168.2.4
                    Jan 24, 2021 10:24:52.208093882 CET804968893.184.220.29192.168.2.4
                    Jan 24, 2021 10:24:52.208141088 CET4968780192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:52.208235979 CET4968880192.168.2.493.184.220.29
                    Jan 24, 2021 10:24:52.226140976 CET4434968340.126.31.135192.168.2.4
                    Jan 24, 2021 10:24:52.226186037 CET4434968240.126.31.135192.168.2.4
                    Jan 24, 2021 10:24:52.226263046 CET49683443192.168.2.440.126.31.135
                    Jan 24, 2021 10:24:52.226301908 CET49682443192.168.2.440.126.31.135
                    Jan 24, 2021 10:24:52.226382971 CET4434968140.126.31.135192.168.2.4
                    Jan 24, 2021 10:24:52.226444960 CET49681443192.168.2.440.126.31.135
                    Jan 24, 2021 10:24:52.238904953 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:52.239022970 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:52.319817066 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:52.319921970 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:52.507154942 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:52.507349968 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:52.589071989 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:52.589237928 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:52.775427103 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:52.775521040 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:52.857549906 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:52.857676029 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:53.044110060 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:53.044199944 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:53.127254963 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:53.127372026 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:53.316621065 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:53.316842079 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:53.397062063 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:53.397192955 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:53.585668087 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:53.585906982 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:53.665972948 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:53.666102886 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:53.857163906 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:53.857336044 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:53.934221029 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:53.934329033 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:54.125595093 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:54.125682116 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:54.203318119 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:54.203411102 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:54.395068884 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:54.395226002 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:54.472225904 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:54.472315073 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:54.663928032 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:54.664071083 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:54.741497993 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:54.741610050 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:54.932316065 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:54.932586908 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:55.010271072 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:55.010534048 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:55.210603952 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:55.210728884 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:55.278749943 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:55.278855085 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:55.479554892 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:55.479738951 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:55.547542095 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:55.547776937 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:55.748570919 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:55.748764038 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:55.816817045 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:55.816941023 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:56.016659975 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:56.016762972 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:56.084697008 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:56.084783077 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:56.439024925 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:57.141978979 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:58.439088106 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:58.658382893 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:58.658638954 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:58.926501036 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:58.926610947 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:59.198493004 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:59.198596001 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:59.467097044 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:59.467199087 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:24:59.736037016 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:24:59.736176014 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:00.004898071 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:00.009469986 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:00.279738903 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:00.279871941 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:00.548027992 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:00.548173904 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:00.816198111 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:00.816298008 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:01.084546089 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:01.084662914 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:01.353806019 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:01.353905916 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:01.622065067 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:01.622251034 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:01.900883913 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:01.901091099 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:02.169213057 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:02.169425011 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:02.437884092 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:02.438002110 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:02.706109047 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:02.706192017 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:02.974900007 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:02.975006104 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:03.245841980 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:03.246011972 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:03.516577005 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:03.516772985 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:03.785427094 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:03.785567999 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:04.054411888 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:04.054568052 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:04.322794914 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:04.322896957 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:04.591923952 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:04.592142105 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:04.862068892 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:04.862157106 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:05.140609026 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:05.140750885 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:05.318269968 CET44349701204.79.197.200192.168.2.4
                    Jan 24, 2021 10:25:05.409532070 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:05.409619093 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:05.678798914 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:05.678910971 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:05.947104931 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:05.947381973 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:06.009604931 CET804970793.184.220.29192.168.2.4
                    Jan 24, 2021 10:25:06.009776115 CET4970780192.168.2.493.184.220.29
                    Jan 24, 2021 10:25:06.216638088 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:06.216909885 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:06.485739946 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:06.485903978 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:06.753957987 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:06.754064083 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:07.022171021 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:07.022286892 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:07.291866064 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:07.292124987 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:07.561003923 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:07.561110020 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:07.679440022 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:07.830420017 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:07.830729961 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:07.898576021 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:07.898680925 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:07.987287998 CET44349702204.79.197.200192.168.2.4
                    Jan 24, 2021 10:25:08.100558996 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:08.100708961 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:08.167654037 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:08.167772055 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:08.278325081 CET44349699204.79.197.200192.168.2.4
                    Jan 24, 2021 10:25:08.278882027 CET44349705204.79.197.200192.168.2.4
                    Jan 24, 2021 10:25:08.368813992 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:08.368916035 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:08.439265013 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:08.549748898 CET4434971013.107.42.23192.168.2.4
                    Jan 24, 2021 10:25:08.637607098 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:08.637706995 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:08.669476032 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:08.888273954 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:08.888361931 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:08.936176062 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:09.157208920 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:09.157329082 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:09.426207066 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:09.426316023 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:09.695178986 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:09.695285082 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:09.699049950 CET44349698204.79.197.200192.168.2.4
                    Jan 24, 2021 10:25:09.890197039 CET44349700204.79.197.200192.168.2.4
                    Jan 24, 2021 10:25:09.959615946 CET44349703204.79.197.200192.168.2.4
                    Jan 24, 2021 10:25:09.963783979 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:09.963912964 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:10.235433102 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:10.235539913 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:10.246742010 CET4434970813.107.5.88192.168.2.4
                    Jan 24, 2021 10:25:10.504143000 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:10.504251957 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:10.605376959 CET44349704204.79.197.200192.168.2.4
                    Jan 24, 2021 10:25:10.772947073 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:10.773081064 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:11.041670084 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:11.041863918 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:11.142512083 CET4434970913.107.5.88192.168.2.4
                    Jan 24, 2021 10:25:11.310424089 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:11.310537100 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:11.579118967 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:11.579272032 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:11.847428083 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:11.847585917 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:11.989367008 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:12.092156887 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:12.116403103 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.170695066 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:12.172115088 CET44349715204.79.197.222192.168.2.4
                    Jan 24, 2021 10:25:12.208189964 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.208236933 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.250076056 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:12.311028004 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.311070919 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.389642954 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.389686108 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.389746904 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:12.469042063 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.469257116 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:12.659431934 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.662571907 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:12.738796949 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.738878012 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:12.939498901 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:12.939615965 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:13.009527922 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:13.009603024 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:13.210366964 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:13.210443020 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:13.278295994 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:13.434866905 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:13.479104996 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:13.653752089 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:13.653937101 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:13.922641993 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:13.922785997 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:14.193414927 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:14.193538904 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:14.461852074 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:14.462007999 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:14.483470917 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:14.702274084 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:14.702451944 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:14.761816025 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:14.981149912 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:14.981362104 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:15.241889954 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:15.242021084 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:15.510221958 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:15.510304928 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:15.778426886 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:15.778532982 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:16.060941935 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:16.061047077 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:16.329827070 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:16.330060005 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:16.598242044 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:16.598447084 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:16.866916895 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:16.867100000 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:17.135126114 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:17.135281086 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:17.403434038 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:17.403614044 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:17.672471046 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:17.672673941 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:17.941854000 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:17.941977024 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:18.210589886 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:18.210741997 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:18.479249001 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:18.479408026 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:18.747505903 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:18.747643948 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:19.016108990 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:19.301820993 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:19.429673910 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:19.570580959 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:19.570741892 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:19.699790001 CET1352749744110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:19.839732885 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:19.839920044 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:20.108160019 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:20.108325005 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:20.161662102 CET804970793.184.220.29192.168.2.4
                    Jan 24, 2021 10:25:20.161837101 CET4970780192.168.2.493.184.220.29
                    Jan 24, 2021 10:25:20.377080917 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:20.377254009 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:20.645407915 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:20.852606058 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:21.131155968 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:21.131283045 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:21.400587082 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:21.400790930 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:21.669661999 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:21.669862032 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:21.938733101 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:21.938947916 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:22.207583904 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:22.207676888 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:22.477802992 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:22.477909088 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:22.746829033 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:22.746915102 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:23.015248060 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:23.017405987 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:23.285511971 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:23.285794973 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:23.554758072 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:23.555485964 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:23.825571060 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:23.825710058 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:24.094038963 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:24.094124079 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:24.362963915 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:24.363495111 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:24.631658077 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:24.631743908 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:24.900302887 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:24.903404951 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:25.171988964 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:25.173912048 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:25.442148924 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:25.447627068 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:25.716079950 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:25.716372967 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:25.984467030 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:25.984622955 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:26.253187895 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:26.253884077 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:26.523453951 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:26.523643017 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:26.793775082 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:26.794178009 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:27.062589884 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:27.063272953 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:27.332279921 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:27.332389116 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:27.600822926 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:27.603584051 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:27.872706890 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:27.873569012 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:28.142493010 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:28.142584085 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:28.411519051 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:28.411621094 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:28.679925919 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:28.680083036 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:28.950053930 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:28.951919079 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:29.219504118 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:29.220015049 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:29.489149094 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:29.492090940 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:29.760782957 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:29.764039993 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:30.032726049 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:30.032829046 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:30.311604977 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:30.311722040 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:30.580347061 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:30.580459118 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:30.849612951 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:30.850210905 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:31.119383097 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:31.122268915 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:31.391403913 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:31.392136097 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:31.660047054 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:31.660253048 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:31.928343058 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:31.928462982 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:32.198287010 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:32.198410034 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:32.466777086 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:32.466887951 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:32.735479116 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:32.735675097 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:33.004374981 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:33.004971981 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:33.274585009 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:33.274689913 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:33.543323994 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:33.543417931 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:33.821815014 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:33.821902990 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:34.089786053 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:34.091139078 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:34.359627008 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:34.359741926 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:34.628345013 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:34.628453016 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:34.897989035 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:34.898721933 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:34.994081974 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:35.167524099 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:35.167637110 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:35.212827921 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:35.436116934 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:35.436244965 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:35.704838991 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:35.705209017 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:35.789550066 CET44349696204.79.197.200192.168.2.4
                    Jan 24, 2021 10:25:35.973540068 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:35.974869013 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:36.038981915 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:36.243877888 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:36.244633913 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:36.257977009 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:36.514252901 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:36.514350891 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:36.785731077 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:36.785995007 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:37.055166960 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:37.055274010 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:37.323863983 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:37.324106932 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:37.548943996 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:37.592978954 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:37.673412085 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:37.767819881 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:37.767844915 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:37.768060923 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:37.870428085 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:37.892501116 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:38.037353992 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:38.037563086 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:38.089272022 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:38.089548111 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:38.308374882 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:38.308840036 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:38.577912092 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:38.578017950 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:38.846225977 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:38.846391916 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:39.115302086 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:39.115736008 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:39.384159088 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:39.384387970 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:39.652415991 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:39.653819084 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:39.921762943 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:39.921943903 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:40.189997911 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:40.190288067 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:40.459741116 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:40.460187912 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:40.728326082 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:40.732275963 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:41.000852108 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:41.001213074 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:41.270035028 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:41.270123005 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:41.538613081 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:41.538708925 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:41.806782961 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:41.806895018 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:42.075192928 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:42.075742006 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:42.345067978 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:42.345768929 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:42.614276886 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:42.614376068 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:42.885521889 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:42.885649920 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:43.155566931 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:43.155860901 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:43.424901009 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:43.425229073 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:43.694047928 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:43.694153070 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:43.962793112 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:43.962922096 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:44.230937004 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:44.231046915 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:44.499701023 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:44.499792099 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:44.769310951 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:44.770132065 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:45.039064884 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:45.039186001 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:45.307105064 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:45.307214975 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:45.575519085 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:45.575668097 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:45.845530987 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:45.845948935 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:46.114037037 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:46.114161968 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:46.382684946 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:46.382801056 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:46.650896072 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:46.651015997 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:46.919786930 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:46.921416998 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:47.189661026 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:47.190571070 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:47.458534002 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:47.458667040 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:47.727315903 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:47.727509975 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:47.996248960 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:47.996428013 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:48.264758110 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:48.265588045 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:48.534209967 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:48.537630081 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:48.804461956 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:48.804667950 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:49.073492050 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:49.073601007 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:49.345246077 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:49.345331907 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:49.614111900 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:49.614449978 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:49.882350922 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:49.883657932 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:50.161946058 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:50.162249088 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:50.430856943 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:50.431824923 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:50.701349020 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:50.701440096 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:50.957868099 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:50.971667051 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:50.972004890 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:51.232930899 CET1352749744110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:51.240814924 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:51.240953922 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:51.509495020 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:51.509670973 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:51.777699947 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:51.777831078 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:52.045835972 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:52.045934916 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:52.314860106 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:52.314974070 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:52.583288908 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:52.585428953 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:52.853586912 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:52.853761911 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:53.131726980 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:53.134107113 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:53.403244972 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:53.403343916 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:53.674995899 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:53.676291943 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:53.944113970 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:53.944233894 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:54.068289995 CET4974413527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:54.068381071 CET4974613527192.168.2.4110.92.66.246
                    Jan 24, 2021 10:25:54.212507010 CET1352749746110.92.66.246192.168.2.4
                    Jan 24, 2021 10:25:54.212594986 CET4974613527192.168.2.4110.92.66.246

                    UDP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Jan 24, 2021 10:23:13.309921980 CET5585453192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:13.332984924 CET53558548.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:13.920188904 CET6454953192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:13.943337917 CET53645498.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:14.716948032 CET6315353192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:14.740032911 CET53631538.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:15.511826038 CET5299153192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:15.535604000 CET53529918.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:16.968394041 CET5370053192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:16.991550922 CET53537008.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:17.860275030 CET5172653192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:17.883440971 CET53517268.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:19.125066996 CET5679453192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:19.150897026 CET53567948.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:19.983750105 CET5653453192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:20.006917000 CET53565348.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:20.637813091 CET5662753192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:20.664338112 CET53566278.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:21.486450911 CET5662153192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:21.512278080 CET53566218.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:22.337990046 CET6311653192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:22.361217976 CET53631168.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:23.166867018 CET6407853192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:23.201261997 CET53640788.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:37.773974895 CET6480153192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:37.796924114 CET53648018.8.8.8192.168.2.4
                    Jan 24, 2021 10:23:40.221301079 CET6172153192.168.2.48.8.8.8
                    Jan 24, 2021 10:23:40.253931046 CET53617218.8.8.8192.168.2.4
                    Jan 24, 2021 10:24:03.344569921 CET5125553192.168.2.48.8.8.8
                    Jan 24, 2021 10:24:03.370654106 CET53512558.8.8.8192.168.2.4
                    Jan 24, 2021 10:24:32.072946072 CET6152253192.168.2.48.8.8.8
                    Jan 24, 2021 10:24:32.110757113 CET53615228.8.8.8192.168.2.4

                    HTTP Request Dependency Graph

                    • 110.92.66.246:13527

                    HTTP Packets

                    Session IDSource IPSource PortDestination IPDestination PortProcess
                    0192.168.2.449744110.92.66.24613527C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    TimestampkBytes transferredDirectionData
                    Jan 24, 2021 10:23:44.673149109 CET405OUTGET /\ HTTP/1.1
                    Connection: Upgrade
                    Sec-WebSocket-Key: FCzEFfJJGECxZCsRaGKFlJqHW
                    Sec-WebSocket-Version: 13
                    Upgrade: websocket
                    Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
                    Host: 110.92.66.246:13527


                    Session IDSource IPSource PortDestination IPDestination PortProcess
                    1110.92.66.24613527192.168.2.449744C:\Users\user\zT6Nm@i4\PMRunner64.exe
                    TimestampkBytes transferredDirectionData
                    Jan 24, 2021 10:23:44.892343998 CET406INHTTP/1.1 101 Switching Protocols
                    Connection: Upgrade
                    Upgrade: WebSocket
                    Sec-WebSocket-Accept: J6aOSpBDe/Sy9K0gZYEbzVgYYn8=
                    Content-Length: 0


                    Session IDSource IPSource PortDestination IPDestination PortProcess
                    2192.168.2.449745110.92.66.24613527C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    TimestampkBytes transferredDirectionData
                    Jan 24, 2021 10:23:50.193909883 CET407OUTGET /\ HTTP/1.1
                    Connection: Upgrade
                    Sec-WebSocket-Key: hVvGEJDDITDIJDJeQLtIKCsnC
                    Sec-WebSocket-Version: 13
                    Upgrade: websocket
                    Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
                    Host: 110.92.66.246:13527


                    Session IDSource IPSource PortDestination IPDestination PortProcess
                    3110.92.66.24613527192.168.2.449745C:\Users\user\zT6Nm@i4\PMRunner64.exe
                    TimestampkBytes transferredDirectionData
                    Jan 24, 2021 10:23:50.387290955 CET407INHTTP/1.1 101 Switching Protocols
                    Connection: Upgrade
                    Upgrade: WebSocket
                    Sec-WebSocket-Accept: Zt5ptgVJyb+M21WHDTqV3GKtCPo=
                    Content-Length: 0


                    Session IDSource IPSource PortDestination IPDestination PortProcess
                    4192.168.2.449746110.92.66.24613527C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    TimestampkBytes transferredDirectionData
                    Jan 24, 2021 10:23:54.288530111 CET607OUTGET /\ HTTP/1.1
                    Connection: Upgrade
                    Sec-WebSocket-Key: IKBXBepAaaBfkIYjnCKuMRKkF
                    Sec-WebSocket-Version: 13
                    Upgrade: websocket
                    Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
                    Host: 110.92.66.246:13527


                    Session IDSource IPSource PortDestination IPDestination PortProcess
                    5110.92.66.24613527192.168.2.449746C:\Users\user\zT6Nm@i4\PMRunner64.exe
                    TimestampkBytes transferredDirectionData
                    Jan 24, 2021 10:23:54.507450104 CET607INHTTP/1.1 101 Switching Protocols
                    Connection: Upgrade
                    Upgrade: WebSocket
                    Sec-WebSocket-Accept: Kj9tthj3c2jmoKNtKOHJo/S2svQ=
                    Content-Length: 0


                    Code Manipulations

                    Statistics

                    CPU Usage

                    Click to jump to process

                    Memory Usage

                    Click to jump to process

                    High Level Behavior Distribution

                    Click to dive into process behavior distribution

                    Behavior

                    Click to jump to process

                    System Behavior

                    General

                    Start time:10:23:18
                    Start date:24/01/2021
                    Path:C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe
                    Wow64 process (32bit):false
                    Commandline:'C:\Users\user\Desktop\#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.exe'
                    Imagebase:0x140000000
                    File size:3150336 bytes
                    MD5 hash:6665909A2652C5860FD874CB15C3991C
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low

                    General

                    Start time:10:23:22
                    Start date:24/01/2021
                    Path:C:\Users\user\zT6Nm@i4\zr.exe
                    Wow64 process (32bit):true
                    Commandline:'C:\Users\user\zT6Nm@i4\zr.exe' a 'C:\Users\user\zT6Nm@i4\111.7z' 'C:\Users\user\zT6Nm@i4\TXP\*'
                    Imagebase:0x400000
                    File size:461088 bytes
                    MD5 hash:045FCBE6C174AFA9A6A998BDD6F9FAD7
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Antivirus matches:
                    • Detection: 0%, Virustotal, Browse
                    • Detection: 0%, Metadefender, Browse
                    • Detection: 0%, ReversingLabs
                    Reputation:low

                    General

                    Start time:10:23:22
                    Start date:24/01/2021
                    Path:C:\Windows\System32\conhost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Imagebase:0x7ff724c50000
                    File size:625664 bytes
                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high

                    General

                    Start time:10:23:24
                    Start date:24/01/2021
                    Path:C:\Windows\System32\cmd.exe
                    Wow64 process (32bit):false
                    Commandline:'C:\Windows\System32\cmd.exe' /C 'C:\Users\user\zT6Nm@i4\copy.bat'
                    Imagebase:0x7ff622070000
                    File size:273920 bytes
                    MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high

                    General

                    Start time:10:23:24
                    Start date:24/01/2021
                    Path:C:\Windows\System32\conhost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Imagebase:0x7ff724c50000
                    File size:625664 bytes
                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high

                    General

                    Start time:10:23:28
                    Start date:24/01/2021
                    Path:C:\ProgramData\Microsoft\zr.exe
                    Wow64 process (32bit):true
                    Commandline:'C:\ProgramData\Microsoft\zr.exe' x C:\ProgramData\Microsoft\111.7z -y
                    Imagebase:0x400000
                    File size:461088 bytes
                    MD5 hash:045FCBE6C174AFA9A6A998BDD6F9FAD7
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Antivirus matches:
                    • Detection: 0%, Virustotal, Browse
                    • Detection: 0%, Metadefender, Browse
                    • Detection: 0%, ReversingLabs
                    Reputation:low

                    General

                    Start time:10:23:28
                    Start date:24/01/2021
                    Path:C:\Windows\System32\conhost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Imagebase:0x7ff724c50000
                    File size:625664 bytes
                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high

                    General

                    Start time:10:23:37
                    Start date:24/01/2021
                    Path:C:\Users\user\zT6Nm@i4\PMRunner64.exe
                    Wow64 process (32bit):false
                    Commandline:'C:\Users\user\zT6Nm@i4\PMRunner64.exe'
                    Imagebase:0x7ff7a5160000
                    File size:271704 bytes
                    MD5 hash:65DBB57517611D9DE8CE522022DCD727
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Antivirus matches:
                    • Detection: 0%, Virustotal, Browse
                    • Detection: 0%, Metadefender, Browse
                    • Detection: 0%, ReversingLabs
                    Reputation:low

                    General

                    Start time:10:23:48
                    Start date:24/01/2021
                    Path:C:\Users\user\zT6Nm@i4\PMRunner64.exe
                    Wow64 process (32bit):false
                    Commandline:'C:\Users\user\zT6Nm@i4\PMRunner64.exe'
                    Imagebase:0x7ff7a5160000
                    File size:271704 bytes
                    MD5 hash:65DBB57517611D9DE8CE522022DCD727
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low

                    General

                    Start time:10:23:56
                    Start date:24/01/2021
                    Path:C:\Users\user\zT6Nm@i4\PMRunner64.exe
                    Wow64 process (32bit):false
                    Commandline:'C:\Users\user\zT6Nm@i4\PMRunner64.exe'
                    Imagebase:0x7ff7a5160000
                    File size:271704 bytes
                    MD5 hash:65DBB57517611D9DE8CE522022DCD727
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low

                    Disassembly

                    Code Analysis

                    Reset < >

                      Execution Graph

                      Execution Coverage:3.2%
                      Dynamic/Decrypted Code Coverage:12%
                      Signature Coverage:24.6%
                      Total number of Nodes:1374
                      Total number of Limit Nodes:59

                      Graph

                      execution_graph 66787 1400bec6c 66788 1400beca1 _RunAllParam 66787->66788 66789 1400becea 66788->66789 66797 1400011a8 66788->66797 66791 1400bedf2 CreateCompatibleDC CreateCompatibleDC 66789->66791 66794 1400bee23 66789->66794 66792 1400bee19 66791->66792 66792->66794 66803 140017970 RaiseException _RunAllParam 66792->66803 66804 1400be798 335 API calls _RunAllParam 66794->66804 66796 1400beecf 66798 1400011b4 66797->66798 66799 1400011b9 66797->66799 66805 1400142b0 RaiseException _RunAllParam 66798->66805 66806 140014588 65 API calls 3 library calls 66799->66806 66802 1400011bf 66804->66796 66806->66802 66807 18000f764 66808 18000f796 66807->66808 66809 18000f779 66807->66809 66811 18000f7ae RtlAllocateHeap 66808->66811 66813 18000f7cf _callnewh 66808->66813 66814 18000f78c 66808->66814 66809->66808 66810 18000f787 66809->66810 66815 18000e164 _getptd_noexit 66810->66815 66811->66808 66811->66814 66813->66808 66813->66814 66815->66814 66816 140002ec4 66817 140002edb 66816->66817 66820 140002dc8 66817->66820 66821 140002eb4 66820->66821 66822 140002e07 RegOpenKeyExW 66820->66822 66823 140002e2d 66822->66823 66823->66821 66823->66822 66824 140002e33 RegQueryValueExW 66823->66824 66825 140002e97 RegCloseKey 66823->66825 66824->66823 66825->66823 66826 1400206a8 GetVersionExW GetSystemMetrics 66827 14002086e 66826->66827 66844 14001f9a8 GetSysColor 66827->66844 66832 14002095e 66834 140003484 104 API calls 66832->66834 66833 1400208be 6 API calls 66833->66832 66835 140020994 66834->66835 66836 1400209ef 66835->66836 66837 1400209a0 GetProcAddress GetProcAddress GetProcAddress 66835->66837 66934 14002007c 66836->66934 66837->66836 66841 140020a56 67022 140154b40 66841->67022 66843 140020ad8 66845 14001f9ea GetSysColor 66844->66845 66846 14001f9de GetSysColor 66844->66846 66848 14001fa05 GetSysColor 66845->66848 66849 14001fa14 66845->66849 66846->66845 66848->66849 67033 140018580 66849->67033 66852 14001fb75 66854 14001fb99 GetSysColorBrush 66852->66854 66853 14001fb80 GetSysColor 66853->66854 66855 14001fbb4 66854->66855 66856 14001fbba GetSysColorBrush 66854->66856 67068 1400142f8 RaiseException _RunAllParam 66855->67068 66858 14001fbd5 66856->66858 66859 14001fbdb GetSysColorBrush 66856->66859 67069 1400142f8 RaiseException _RunAllParam 66858->67069 66862 14001fbf6 66859->66862 66863 14001fbfb 66859->66863 67070 1400142f8 RaiseException _RunAllParam 66862->67070 67040 140018810 66863->67040 66870 140018810 _RunAllParam 100 API calls 66871 14001fc2c CreateSolidBrush 66870->66871 66872 140018790 99 API calls 66871->66872 66873 14001fc44 66872->66873 66874 140018810 _RunAllParam 100 API calls 66873->66874 66875 14001fc50 CreateSolidBrush 66874->66875 66876 140018790 99 API calls 66875->66876 66877 14001fc6b 66876->66877 66878 140018810 _RunAllParam 100 API calls 66877->66878 66879 14001fc77 CreateSolidBrush 66878->66879 66880 140018790 99 API calls 66879->66880 66881 14001fc92 66880->66881 66882 140018810 _RunAllParam 100 API calls 66881->66882 66883 14001fc9e CreateSolidBrush 66882->66883 66884 140018790 99 API calls 66883->66884 66885 14001fcb6 66884->66885 66886 140018810 _RunAllParam 100 API calls 66885->66886 66887 14001fcc2 CreateSolidBrush 66886->66887 66888 140018790 99 API calls 66887->66888 66889 14001fcda 66888->66889 66890 140018810 _RunAllParam 100 API calls 66889->66890 66891 14001fce6 CreateSolidBrush 66890->66891 66892 140018790 99 API calls 66891->66892 66893 14001fcfe 66892->66893 66894 140018810 _RunAllParam 100 API calls 66893->66894 66895 14001fd0a CreatePen 66894->66895 66896 140018790 99 API calls 66895->66896 66897 14001fd2a 66896->66897 66898 140018810 _RunAllParam 100 API calls 66897->66898 66899 14001fd36 CreatePen 66898->66899 66900 140018790 99 API calls 66899->66900 66901 14001fd56 66900->66901 66902 140018810 _RunAllParam 100 API calls 66901->66902 66903 14001fd62 CreatePen 66902->66903 66904 140018790 99 API calls 66903->66904 66905 14001fd82 66904->66905 66906 14001fd9d 66905->66906 66909 140018810 _RunAllParam 100 API calls 66905->66909 66907 14001fda6 CreateSolidBrush 66906->66907 66908 14001fe0e 66906->66908 66910 140018790 99 API calls 66907->66910 67071 14001e2f8 10 API calls 2 library calls 66908->67071 66909->66906 66912 14001fe0c 66910->66912 67051 140055244 66912->67051 66913 14001fe1b 66914 14001fe2c 66913->66914 67072 1400142f8 RaiseException _RunAllParam 66913->67072 66916 140018790 99 API calls 66914->66916 66918 14001fe4c CreatePatternBrush 66916->66918 66920 140018790 99 API calls 66918->66920 66922 14001fe62 66920->66922 67073 140009af8 66922->67073 66923 14001fe87 66925 140003484 66923->66925 67156 140015a44 66925->67156 66928 1400034c1 LoadLibraryW 66929 1400034e9 66928->66929 66930 1400034df GetLastError 66928->66930 66931 1400034eb DeactivateActCtx 66929->66931 66930->66931 66932 1400034bd 66931->66932 66933 1400034fc SetLastError 66931->66933 66932->66832 66932->66833 66933->66932 66935 140018580 100 API calls 66934->66935 66936 1400200cf GetDeviceCaps 66935->66936 66938 14002010b 66936->66938 66937 140020150 66939 140020173 66937->66939 67240 1400187cc 99 API calls _RunAllParam 66937->67240 66938->66937 67239 1400187cc 99 API calls _RunAllParam 66938->67239 66940 140020196 66939->66940 67241 1400187cc 99 API calls _RunAllParam 66939->67241 66942 1400201b9 66940->66942 67242 1400187cc 99 API calls _RunAllParam 66940->67242 66947 1400201dc 66942->66947 67243 1400187cc 99 API calls _RunAllParam 66942->67243 66943 140020147 DeleteObject 66943->66937 66945 14002016a DeleteObject 66945->66939 66948 1400201ff 66947->66948 67244 1400187cc 99 API calls _RunAllParam 66947->67244 66951 140020223 66948->66951 67245 1400187cc 99 API calls _RunAllParam 66948->67245 66949 14002018d DeleteObject 66949->66940 66955 140020246 66951->66955 67246 1400187cc 99 API calls _RunAllParam 66951->67246 66952 1400201b0 DeleteObject 66952->66942 66957 140020269 66955->66957 67247 1400187cc 99 API calls _RunAllParam 66955->67247 66956 1400201d3 DeleteObject 66956->66947 66960 14002028d 66957->66960 67248 1400187cc 99 API calls _RunAllParam 66957->67248 66958 1400201f6 DeleteObject 66958->66948 67236 14001e628 66960->67236 66961 14002021a DeleteObject 66961->66951 66965 14002023d DeleteObject 66965->66955 66966 140020260 DeleteObject 66966->66957 66968 140020299 _recalloc 66970 1400202a9 GetTextCharsetInfo 66968->66970 66969 140020284 DeleteObject 66969->66960 66971 1400202e7 lstrcpyW 66970->66971 66973 140020315 66971->66973 66974 14002038e CreateFontIndirectW 66971->66974 66973->66974 66975 14002031e EnumFontFamiliesW 66973->66975 66976 140018790 99 API calls 66974->66976 66977 140020356 EnumFontFamiliesW 66975->66977 66978 14002033d lstrcpyW 66975->66978 66981 1400203a4 66976->66981 66979 140020381 66977->66979 66980 140020388 lstrcpyW 66977->66980 66978->66974 66979->66980 66980->66974 66982 1400203dd CreateFontIndirectW 66981->66982 66983 140018790 99 API calls 66982->66983 66984 1400203f3 66983->66984 66985 14001e628 103 API calls 66984->66985 66986 140020406 CreateFontIndirectW 66985->66986 66987 140018790 99 API calls 66986->66987 66988 140020436 CreateFontIndirectW 66987->66988 66989 140018790 99 API calls 66988->66989 66990 14002046b CreateFontIndirectW 66989->66990 66991 140018790 99 API calls 66990->66991 66992 140020495 GetSystemMetrics lstrcpyW CreateFontIndirectW 66991->66992 66993 140018790 99 API calls 66992->66993 66994 1400204df GetStockObject 66993->66994 66995 140020593 GetStockObject 66994->66995 66996 14002050c GetObjectW 66994->66996 66997 14001876c 99 API calls 66995->66997 66996->66995 66998 140020522 lstrcpyW CreateFontIndirectW 66996->66998 66999 1400205a6 GetObjectW CreateFontIndirectW 66997->66999 67000 140018790 99 API calls 66998->67000 67001 140018790 99 API calls 66999->67001 67002 140020579 CreateFontIndirectW 67000->67002 67003 1400205d5 CreateFontIndirectW 67001->67003 67004 140018790 99 API calls 67002->67004 67005 140018790 99 API calls 67003->67005 67004->66995 67006 1400205f8 67005->67006 67007 14001e6ec 105 API calls 67006->67007 67009 140020600 67007->67009 67008 140020644 67012 140009af8 _RunAllParam 100 API calls 67008->67012 67009->67008 67010 14002064b 67009->67010 67013 140020646 67009->67013 67016 14000e6c8 99 API calls 67009->67016 67011 1400142f8 _RunAllParam RaiseException 67010->67011 67011->67008 67015 140020668 67012->67015 67014 1400142f8 _RunAllParam RaiseException 67013->67014 67014->67010 67017 1400185e4 _RunAllParam 100 API calls 67015->67017 67016->67009 67018 140020673 67017->67018 67019 140154b40 _RunAllParam 8 API calls 67018->67019 67020 140020682 67019->67020 67021 14001e1e4 8 API calls 67020->67021 67021->66841 67023 140154b49 67022->67023 67024 14015c438 RtlCaptureContext RtlLookupFunctionEntry 67023->67024 67025 140154b54 67023->67025 67026 14015c4bd 67024->67026 67027 14015c47c RtlVirtualUnwind 67024->67027 67025->66843 67028 14015c4df IsDebuggerPresent 67026->67028 67027->67028 67260 140165a64 67028->67260 67030 14015c53e SetUnhandledExceptionFilter UnhandledExceptionFilter 67031 14015c566 GetCurrentProcess TerminateProcess 67030->67031 67032 14015c55c _RunAllParam 67030->67032 67031->66843 67032->67031 67034 1400185b3 GetWindowDC 67033->67034 67078 1400183f0 67034->67078 67038 1400185d9 22 API calls 67038->66852 67038->66853 67041 140018822 67040->67041 67042 14001881b CreateSolidBrush 67040->67042 67147 1400187cc 99 API calls _RunAllParam 67041->67147 67045 140018790 67042->67045 67044 140018827 DeleteObject 67046 1400187a2 67045->67046 67050 14001879e 67045->67050 67148 1400186c8 99 API calls _RunAllParam 67046->67148 67048 1400187b0 67049 1400243f0 _RunAllParam 63 API calls 67048->67049 67049->67050 67050->66870 67052 14001fe77 67051->67052 67053 140055251 67051->67053 67065 1400185e4 67052->67065 67053->67052 67149 1400bb4ec 66 API calls _RunAllParam 67053->67149 67055 140055266 67150 1400bb4ec 66 API calls _RunAllParam 67055->67150 67057 140055272 67151 1400bb4ec 66 API calls _RunAllParam 67057->67151 67059 14005527e 67152 1400bb4ec 66 API calls _RunAllParam 67059->67152 67061 14005528a 67153 1400bb4ec 66 API calls _RunAllParam 67061->67153 67063 140055296 67154 1400bb4ec 66 API calls _RunAllParam 67063->67154 67155 14001843c 99 API calls _RunAllParam 67065->67155 67067 140018609 ReleaseDC 67071->66913 67074 140018810 _RunAllParam 100 API calls 67073->67074 67075 140009b29 67074->67075 67076 140154b40 _RunAllParam 8 API calls 67075->67076 67077 140009b3a 67076->67077 67077->66912 67079 140018402 67078->67079 67083 1400183fe 67078->67083 67085 140018328 99 API calls _RunAllParam 67079->67085 67081 140018410 67086 1400243f0 67081->67086 67083->67038 67084 140017970 RaiseException _RunAllParam 67083->67084 67085->67081 67089 14002440f _RunAllParam 67086->67089 67087 140024434 67087->67083 67088 14002442c 67092 140024248 67088->67092 67089->67087 67089->67088 67096 14006ab5c 62 API calls 2 library calls 67089->67096 67093 14002426b 67092->67093 67094 140024258 67092->67094 67093->67087 67097 1400252ec 67094->67097 67096->67088 67098 14002531b 67097->67098 67099 1400252fa 67097->67099 67109 1400142f8 RaiseException _RunAllParam 67098->67109 67099->67098 67101 1400252ff 67099->67101 67105 140002d74 67101->67105 67107 140002d83 67105->67107 67108 140002da8 67107->67108 67110 1401556ac 67107->67110 67108->67093 67111 1401556c4 67110->67111 67112 140155740 67110->67112 67115 1401556fc RtlAllocateHeap 67111->67115 67116 1401556dc 67111->67116 67120 140155725 67111->67120 67124 14015572a 67111->67124 67130 14015e2a0 DecodePointer 67111->67130 67134 14015e2a0 DecodePointer 67112->67134 67114 140155745 67117 140156050 _errno 61 API calls 67114->67117 67115->67111 67119 140155735 67115->67119 67116->67115 67127 140159f5c 62 API calls 2 library calls 67116->67127 67128 140159cfc 62 API calls 4 library calls 67116->67128 67129 1401558f8 GetModuleHandleW GetProcAddress ExitProcess _amsg_exit 67116->67129 67117->67119 67119->67107 67131 140156050 67120->67131 67126 140156050 _errno 61 API calls 67124->67126 67126->67119 67127->67116 67128->67116 67130->67111 67135 14015aa58 GetLastError FlsGetValue 67131->67135 67133 140156059 67133->67124 67134->67114 67136 14015aac6 SetLastError 67135->67136 67137 14015aa7e 67135->67137 67136->67133 67138 14015c604 __wtomb_environ 57 API calls 67137->67138 67139 14015aa8b 67138->67139 67139->67136 67140 14015aa93 FlsSetValue 67139->67140 67141 14015aabf 67140->67141 67142 14015aaa9 67140->67142 67144 140155564 free 57 API calls 67141->67144 67143 14015a9a0 _getptd 57 API calls 67142->67143 67145 14015aab0 GetCurrentThreadId 67143->67145 67146 14015aac4 67144->67146 67145->67136 67146->67136 67147->67044 67148->67048 67149->67055 67150->67057 67151->67059 67152->67061 67153->67063 67154->67052 67155->67067 67165 14001a13c 67156->67165 67158 140015a65 67161 1400034a1 ActivateActCtx 67158->67161 67182 140019a80 67158->67182 67161->66928 67161->66932 67166 14001a167 67165->67166 67167 14001a16c 67165->67167 67218 1400142f8 RaiseException _RunAllParam 67166->67218 67180 14001a1a1 67167->67180 67181 14001a1b5 67167->67181 67219 140019bb0 TlsAlloc InitializeCriticalSection RaiseException _DeleteExceptionPtr 67167->67219 67173 140015a5b 67173->67158 67190 1400142f8 RaiseException _RunAllParam 67173->67190 67174 14001a18f 67174->67180 67220 1400142f8 RaiseException _RunAllParam 67174->67220 67175 14001a1aa 67175->67181 67221 1400142f8 RaiseException _RunAllParam 67175->67221 67176 14001a1cc 67222 140019e2c 73 API calls 2 library calls 67176->67222 67192 140019bfc EnterCriticalSection 67180->67192 67211 1400199f4 EnterCriticalSection 67181->67211 67183 140015a82 67182->67183 67184 140019aa2 67182->67184 67183->67161 67191 1400142f8 RaiseException _RunAllParam 67183->67191 67224 1400213e4 67184->67224 67186 140019aaa 67187 140019ab5 67186->67187 67189 1400159f8 99 API calls 67186->67189 67188 140021478 _RunAllParam LeaveCriticalSection RaiseException 67187->67188 67188->67183 67189->67187 67193 140019c2e 67192->67193 67194 140019d41 _recalloc 67193->67194 67196 140019ca9 GlobalHandle GlobalUnlock 67193->67196 67197 140019c7e 67193->67197 67195 140019d54 LeaveCriticalSection 67194->67195 67195->67175 67199 140019cd7 GlobalReAlloc 67196->67199 67200 140019ccc 67196->67200 67198 140019c9a GlobalAlloc 67197->67198 67202 1400011a8 _DeleteExceptionPtr 65 API calls 67197->67202 67201 140019ce9 67198->67201 67199->67201 67203 1400011a8 _DeleteExceptionPtr 65 API calls 67200->67203 67204 140019d16 GlobalLock 67201->67204 67207 140019d06 LeaveCriticalSection 67201->67207 67208 140019cf7 GlobalHandle GlobalLock 67201->67208 67205 140019c99 67202->67205 67206 140019cd6 67203->67206 67204->67194 67205->67198 67206->67199 67223 1400142b0 RaiseException _RunAllParam 67207->67223 67208->67207 67212 140019a45 LeaveCriticalSection 67211->67212 67213 140019a17 67211->67213 67215 140019a51 67212->67215 67213->67212 67214 140019a1c TlsGetValue 67213->67214 67214->67212 67216 140019a29 67214->67216 67215->67173 67215->67176 67216->67212 67217 140019a2e LeaveCriticalSection 67216->67217 67217->67215 67219->67174 67225 1400213f6 67224->67225 67228 1400213fb 67224->67228 67234 1400142f8 RaiseException _RunAllParam 67225->67234 67227 14002140a 67230 140021458 EnterCriticalSection 67227->67230 67231 14002141b EnterCriticalSection 67227->67231 67228->67227 67235 140021344 InitializeCriticalSection 67228->67235 67232 140021432 InitializeCriticalSection 67231->67232 67233 14002144b LeaveCriticalSection 67231->67233 67232->67233 67233->67230 67235->67227 67249 140032378 67236->67249 67239->66943 67240->66945 67241->66949 67242->66952 67243->66956 67244->66958 67245->66961 67246->66965 67247->66966 67248->66969 67250 140032438 67249->67250 67251 1400323a0 67249->67251 67252 140154b40 _RunAllParam 8 API calls 67250->67252 67253 140015a44 _RunAllParam 99 API calls 67251->67253 67254 14001e636 SystemParametersInfoW 67252->67254 67255 1400323a5 67253->67255 67256 1400323b6 GetModuleHandleW 67255->67256 67257 1400323e0 GetProcAddress 67255->67257 67256->67257 67258 1400323c9 LoadLibraryW 67256->67258 67259 1400323fe _recalloc 67257->67259 67258->67257 67259->67250 67260->67030 67261 1400010ec 67274 14000a6a0 67261->67274 67265 140001126 67291 140008560 67265->67291 67275 14000a6ae 67274->67275 67281 14000a6ce 67274->67281 67277 140019a80 _RunAllParam 99 API calls 67275->67277 67276 140015a44 _RunAllParam 99 API calls 67278 14000111a 67276->67278 67279 14000a6c1 67277->67279 67282 140001548 67278->67282 67279->67281 67337 1400142f8 RaiseException _RunAllParam 67279->67337 67281->67276 67338 140007bc4 67282->67338 67287 140015a44 _RunAllParam 99 API calls 67288 14000159a 67287->67288 67289 140015a44 _RunAllParam 99 API calls 67288->67289 67290 14000159f LoadIconW 67289->67290 67290->67265 67292 140015a44 _RunAllParam 99 API calls 67291->67292 67293 14000859c 67292->67293 67294 1400085e7 67293->67294 67295 140015a44 _RunAllParam 99 API calls 67293->67295 67296 1400085ec LockResource 67294->67296 67297 1400085fd 67294->67297 67298 1400085b4 FindResourceW LoadResource 67295->67298 67296->67297 67335 14000113a 67297->67335 67347 140007ef0 67297->67347 67298->67294 67303 14000864a GetDesktopWindow 67304 140008655 IsWindowEnabled 67303->67304 67332 1400086c7 67303->67332 67306 140008662 EnableWindow 67304->67306 67304->67332 67415 140005134 99 API calls _RunAllParam 67306->67415 67313 14000874c 67316 14000878b 67313->67316 67424 140013710 67313->67424 67314 140008723 67314->67313 67420 140013868 67314->67420 67315 140008704 67417 140013510 67315->67417 67322 14000879e 67316->67322 67323 140008790 EnableWindow 67316->67323 67318 14000867f 67318->67332 67416 1400136e8 IsWindowEnabled 67318->67416 67327 1400087a3 GetActiveWindow 67322->67327 67328 1400087b8 67322->67328 67323->67322 67327->67328 67329 1400087af SetActiveWindow 67327->67329 67427 140007f4c 102 API calls _RunAllParam 67328->67427 67329->67328 67363 140011580 67332->67363 67333 1400087cc 67334 1400087d6 FreeResource 67333->67334 67333->67335 67334->67335 67336 1400089ec 100 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 67335->67336 67339 14000d0c4 99 API calls 67338->67339 67340 140001570 67339->67340 67341 14000d0c4 67340->67341 67344 140004cdc 67341->67344 67345 140015a44 _RunAllParam 99 API calls 67344->67345 67346 140001587 67345->67346 67346->67287 67348 140015a44 _RunAllParam 99 API calls 67347->67348 67349 140007f02 67348->67349 67428 140007710 67349->67428 67352 140011580 91 API calls 67353 140007f3e 67352->67353 67354 14000e7a0 67353->67354 67355 14001a13c _DeleteExceptionPtr 89 API calls 67354->67355 67356 14000e7b9 67355->67356 67357 14000e7c6 67356->67357 67452 1400142f8 RaiseException _RunAllParam 67356->67452 67359 140015a44 _RunAllParam 99 API calls 67357->67359 67360 14000e7cc 67359->67360 67361 140008620 67360->67361 67362 14000e7db UnhookWindowsHookEx 67360->67362 67361->67303 67361->67332 67362->67361 67364 14001a13c _DeleteExceptionPtr 89 API calls 67363->67364 67365 1400115a0 67364->67365 67367 1400115ad 67365->67367 67453 1400142f8 RaiseException _RunAllParam 67365->67453 67368 1400086da 67367->67368 67369 1400115bb GetCurrentThreadId SetWindowsHookExW 67367->67369 67372 14000e684 67368->67372 67369->67368 67370 1400115e1 67369->67370 67454 1400142b0 RaiseException _RunAllParam 67370->67454 67455 14000e5e0 67372->67455 67374 14000e69b 67462 140021738 67374->67462 67376 14000e6a9 67474 140013978 67376->67474 67379 1400082e8 67380 140008323 67379->67380 67381 140008328 67379->67381 67382 140015a44 _RunAllParam 99 API calls 67380->67382 67383 140015a44 _RunAllParam 99 API calls 67381->67383 67382->67381 67384 140008331 67383->67384 67498 140012f60 67384->67498 67387 140012f60 124 API calls 67388 14000835b 67387->67388 67543 14000f5fc 67388->67543 67392 140008365 _RunAllParam 67393 1400083c2 67392->67393 67394 1400011a8 _DeleteExceptionPtr 65 API calls 67392->67394 67414 14000839d 67392->67414 67395 140022f1c 65 API calls 67393->67395 67394->67393 67396 1400083f2 67395->67396 67397 14000844a 67396->67397 67399 140022ed0 66 API calls 67396->67399 67398 140011580 91 API calls 67397->67398 67400 140008460 CreateDialogIndirectParamW 67398->67400 67401 14000840a 67399->67401 67405 1400084a3 67400->67405 67403 140022dcc 73 API calls 67401->67403 67404 14000841d 67403->67404 67406 1400229d0 GlobalFree 67404->67406 67407 14000e7a0 100 API calls 67405->67407 67408 140008439 67406->67408 67409 1400084f6 67407->67409 67408->67397 67410 14000843e GlobalLock 67408->67410 67411 140008520 67409->67411 67412 140008514 DestroyWindow 67409->67412 67410->67397 67413 140008525 GlobalUnlock GlobalFree 67411->67413 67411->67414 67412->67411 67413->67414 67414->67313 67414->67314 67414->67315 67415->67318 67418 14001352a 67417->67418 67419 14001351a GetWindowLongW 67417->67419 67419->67418 67421 1400138aa 67420->67421 67422 14001387a SetWindowPos 67420->67422 67421->67313 67422->67421 67425 140013725 67424->67425 67426 14001371a EnableWindow 67424->67426 67426->67425 67427->67333 67429 140007771 GetWindowLongW 67428->67429 67430 140007732 67428->67430 67431 140007785 GetParent 67429->67431 67444 140007764 67429->67444 67445 1400151fc 67430->67445 67431->67429 67431->67444 67433 1400077a1 GetParent 67433->67433 67434 1400077b2 67433->67434 67435 1400077c8 67434->67435 67437 1400077bc GetLastActivePopup 67434->67437 67438 1400077f4 67435->67438 67440 1400077d2 IsWindowEnabled 67435->67440 67437->67435 67438->67352 67440->67438 67442 1400077df 67440->67442 67441 140007743 67441->67429 67441->67444 67442->67438 67443 1400077e4 EnableWindow 67442->67443 67443->67438 67444->67433 67444->67434 67446 14001a13c _DeleteExceptionPtr 89 API calls 67445->67446 67447 140015213 67446->67447 67448 140007737 67447->67448 67451 1400142f8 RaiseException _RunAllParam 67447->67451 67448->67441 67450 140005134 99 API calls _RunAllParam 67448->67450 67450->67441 67479 140015a94 67455->67479 67457 14000e600 _RunAllParam 67458 140002d74 _RunAllParam 62 API calls 67457->67458 67460 14000e660 _RunAllParam 67457->67460 67459 14000e628 67458->67459 67459->67460 67486 140021660 63 API calls _RunAllParam 67459->67486 67460->67374 67463 140021767 67462->67463 67473 140021760 _RunAllParam 67462->67473 67488 140024340 67463->67488 67465 140021770 67466 140024340 Concurrency::details::ExternalContextBase::~ExternalContextBase RaiseException 67465->67466 67465->67473 67467 140021785 _RunAllParam 67466->67467 67467->67473 67492 1400688e0 67467->67492 67470 1400217cf 67472 1400243f0 _RunAllParam 63 API calls 67470->67472 67472->67473 67473->67376 67475 14001397d 67474->67475 67478 1400086e2 67474->67478 67476 140013997 GetParent 67475->67476 67475->67478 67477 140024340 Concurrency::details::ExternalContextBase::~ExternalContextBase RaiseException 67476->67477 67477->67478 67478->67379 67480 140015a44 _RunAllParam 99 API calls 67479->67480 67481 140015a9d 67480->67481 67482 14001a13c _DeleteExceptionPtr 89 API calls 67481->67482 67483 140015ab0 67482->67483 67485 140015aba 67483->67485 67487 1400142f8 RaiseException _RunAllParam 67483->67487 67485->67457 67486->67460 67489 140024355 67488->67489 67491 14002435a Concurrency::details::ExternalContextBase::~ExternalContextBase 67488->67491 67497 1400142f8 RaiseException _RunAllParam 67489->67497 67491->67465 67493 1400217c2 67492->67493 67494 1400688f0 67492->67494 67493->67470 67496 1400142b0 RaiseException _RunAllParam 67493->67496 67495 1400252ec _RunAllParam 63 API calls 67494->67495 67495->67493 67499 140015a44 _RunAllParam 99 API calls 67498->67499 67501 140012f80 _recalloc 67499->67501 67500 140008351 67500->67387 67501->67500 67502 140015a44 _RunAllParam 99 API calls 67501->67502 67503 140012fb9 67502->67503 67504 140012ff8 67503->67504 67581 140012a38 110 API calls 2 library calls 67503->67581 67507 14001301e 67504->67507 67582 140012a38 110 API calls 2 library calls 67504->67582 67509 14001304b 67507->67509 67583 140012a38 110 API calls 2 library calls 67507->67583 67510 140013076 67509->67510 67584 140012f0c 101 API calls _RunAllParam 67509->67584 67512 1400130a7 67510->67512 67585 140012f0c 101 API calls _RunAllParam 67510->67585 67514 1400130c9 67512->67514 67586 14000f574 111 API calls _RunAllParam 67512->67586 67515 1400130ec 67514->67515 67587 14000f574 111 API calls _RunAllParam 67514->67587 67518 140013108 67515->67518 67588 14000f574 111 API calls _RunAllParam 67515->67588 67520 140013122 67518->67520 67589 14000f574 111 API calls _RunAllParam 67518->67589 67522 14001313f 67520->67522 67590 14000f574 111 API calls _RunAllParam 67520->67590 67523 14001315b 67522->67523 67591 14000f574 111 API calls _RunAllParam 67522->67591 67526 140013178 67523->67526 67592 14000f574 111 API calls _RunAllParam 67523->67592 67528 140013195 67526->67528 67593 14000f574 111 API calls _RunAllParam 67526->67593 67530 1400131b0 67528->67530 67594 14000f574 111 API calls _RunAllParam 67528->67594 67531 1400131c7 67530->67531 67595 14000f574 111 API calls _RunAllParam 67530->67595 67534 1400131e1 67531->67534 67596 14000f574 111 API calls _RunAllParam 67531->67596 67536 1400131fc 67534->67536 67597 14000f574 111 API calls _RunAllParam 67534->67597 67538 140013217 67536->67538 67598 14000f574 111 API calls _RunAllParam 67536->67598 67539 14001322e 67538->67539 67599 14000f574 111 API calls _RunAllParam 67538->67599 67539->67500 67600 14000f574 111 API calls _RunAllParam 67539->67600 67544 140015a44 _RunAllParam 99 API calls 67543->67544 67545 14000f61c 67544->67545 67546 14000f629 67545->67546 67601 1400142f8 RaiseException _RunAllParam 67545->67601 67548 14000f633 _recalloc 67546->67548 67549 14000f68e 67546->67549 67552 14000f645 GetVersionExW 67548->67552 67550 140154b40 _RunAllParam 8 API calls 67549->67550 67551 140008360 67550->67551 67560 140023254 67551->67560 67553 14000f65c 67552->67553 67555 14000f661 67552->67555 67602 1400142f8 RaiseException _RunAllParam 67553->67602 67554 14000f67e 67554->67549 67555->67554 67557 140015a44 _RunAllParam 99 API calls 67555->67557 67558 14000f66e 67557->67558 67603 14000e458 106 API calls _RunAllParam 67558->67603 67604 1400231d4 110 API calls 2 library calls 67560->67604 67562 14002326b 67605 1400231d4 110 API calls 2 library calls 67562->67605 67564 14002327e 67606 1400231d4 110 API calls 2 library calls 67564->67606 67566 140023291 67607 1400231d4 110 API calls 2 library calls 67566->67607 67568 1400232a4 67608 1400231d4 110 API calls 2 library calls 67568->67608 67570 1400232b7 67609 1400231d4 110 API calls 2 library calls 67570->67609 67572 1400232ca 67610 1400231d4 110 API calls 2 library calls 67572->67610 67574 1400232dd 67611 1400231d4 110 API calls 2 library calls 67574->67611 67576 1400232f0 67612 1400231d4 110 API calls 2 library calls 67576->67612 67578 140023303 67613 1400231d4 110 API calls 2 library calls 67578->67613 67580 140023316 67581->67504 67582->67507 67583->67509 67586->67514 67587->67515 67588->67518 67589->67520 67590->67522 67591->67523 67592->67526 67593->67528 67594->67530 67595->67531 67596->67534 67597->67536 67598->67538 67599->67539 67600->67500 67603->67554 67604->67562 67605->67564 67606->67566 67607->67568 67608->67570 67609->67572 67610->67574 67611->67576 67612->67578 67613->67580 67614 180001730 67615 180001743 CreateEventW CreateEventW 67614->67615 67616 180001778 67614->67616 67615->67616 67617 1800017a7 67616->67617 67618 18000177d OutputDebugStringW SetEvent 67616->67618 67619 1800017d6 67617->67619 67620 1800017ac OutputDebugStringW SetEvent 67617->67620 67618->67617 67620->67619 67621 14000f950 67622 14000f97e 67621->67622 67623 14000f977 67621->67623 67629 14000e6c8 67622->67629 67626 14000f9a6 DefWindowProcW 67626->67623 67627 14000f98e 67634 14000f7e0 67627->67634 67630 140015a94 _RunAllParam 99 API calls 67629->67630 67631 14000e6d6 67630->67631 67632 14000e6ed 67631->67632 67633 140024340 Concurrency::details::ExternalContextBase::~ExternalContextBase RaiseException 67631->67633 67632->67626 67632->67627 67633->67632 67635 14001a13c _DeleteExceptionPtr 89 API calls 67634->67635 67636 14000f82d 67635->67636 67638 14000f848 wmemcpy_s 67636->67638 67669 1400142f8 RaiseException _RunAllParam 67636->67669 67639 14000f8d2 67638->67639 67670 14000d224 GetWindowRect GetWindowLongW 67638->67670 67647 14000b978 67639->67647 67643 14000f904 wmemcpy_s 67644 140154b40 _RunAllParam 8 API calls 67643->67644 67645 14000f93b 67644->67645 67645->67623 67671 140011818 67647->67671 67649 14000b9c8 67649->67643 67652 14000f718 67649->67652 67653 14000f723 67652->67653 67661 14000f7d3 67652->67661 67654 140013510 GetWindowLongW 67653->67654 67655 14000f747 67654->67655 67656 14000f7c6 67655->67656 67657 14000f74e GetWindowRect 67655->67657 67659 140154b40 _RunAllParam 8 API calls 67656->67659 67657->67656 67658 14000f77b 67657->67658 67658->67656 67660 14000f784 GetWindow 67658->67660 67659->67661 67662 14000e684 _RunAllParam 100 API calls 67660->67662 67661->67643 67663 14000f79b 67662->67663 67664 14000f7a8 67663->67664 67889 1400136e8 IsWindowEnabled 67663->67889 67664->67656 67856 1400081a8 67664->67856 67670->67639 67672 14001186b 67671->67672 67673 14001188d 67671->67673 67779 140010950 67672->67779 67674 1400118d4 67673->67674 67675 1400118be 67673->67675 67740 14000b9b0 67673->67740 67677 1400118da 67674->67677 67682 1400118f4 67674->67682 67676 14000e684 _RunAllParam 100 API calls 67675->67676 67678 1400118c6 67676->67678 67817 1400110bc 108 API calls _RunAllParam 67677->67817 67816 140011018 107 API calls 67678->67816 67681 1400118f0 67681->67682 67681->67740 67683 1400213e4 _RunAllParam 6 API calls 67682->67683 67682->67740 67684 14001198d 67683->67684 67685 1400119a5 67684->67685 67689 1400119d8 67684->67689 67818 140021478 LeaveCriticalSection RaiseException _RunAllParam 67685->67818 67686 14001233f 67821 140021478 LeaveCriticalSection RaiseException _RunAllParam 67686->67821 67689->67686 67690 140011a74 67689->67690 67693 1400122f1 67689->67693 67819 140021478 LeaveCriticalSection RaiseException _RunAllParam 67690->67819 67691 140011aa4 67698 140011ab4 67691->67698 67699 140011d1a 67691->67699 67747 140011e0b 67691->67747 67692 140011eb3 67694 1400120d6 67692->67694 67706 140011ebd 67692->67706 67820 140021478 LeaveCriticalSection RaiseException _RunAllParam 67693->67820 67708 1400121de 67694->67708 67725 1400120e0 67694->67725 67697 1400119b4 67697->67691 67697->67692 67697->67740 67704 140011ac4 67698->67704 67705 140011c49 67698->67705 67698->67740 67701 140011d24 67699->67701 67713 140011ddb 67699->67713 67700 14000e684 _RunAllParam 100 API calls 67703 140011e1c 67700->67703 67711 140011dd1 67701->67711 67701->67740 67758 140011d34 67701->67758 67702 14000e684 _RunAllParam 100 API calls 67702->67740 67730 14000e684 _RunAllParam 100 API calls 67703->67730 67714 140011bfa 67704->67714 67734 140011b9c 67704->67734 67741 140011ad3 67704->67741 67709 140011ce4 67705->67709 67710 140011c53 67705->67710 67707 140011fb5 67706->67707 67712 140011f93 67706->67712 67717 140011f8b 67706->67717 67706->67740 67744 140011ef1 67706->67744 67715 14000e684 _RunAllParam 100 API calls 67707->67715 67708->67702 67708->67740 67716 14000e684 _RunAllParam 100 API calls 67709->67716 67720 140011c61 67710->67720 67721 140011bc6 67710->67721 67710->67740 67801 1400025a0 67711->67801 67722 14000e684 _RunAllParam 100 API calls 67712->67722 67713->67703 67726 140011e01 67713->67726 67727 140011e50 67713->67727 67713->67740 67718 1400183cc 99 API calls 67714->67718 67715->67740 67716->67740 67728 14000e684 _RunAllParam 100 API calls 67717->67728 67718->67740 67719 14001215c 67729 14000e684 _RunAllParam 100 API calls 67719->67729 67737 140011cbb 67720->67737 67738 140011c6f 67720->67738 67720->67740 67723 14000e684 _RunAllParam 100 API calls 67721->67723 67722->67707 67723->67740 67724 140012144 67739 140015bf8 99 API calls 67724->67739 67725->67719 67725->67724 67732 14001213c 67725->67732 67733 14001210e 67725->67733 67725->67740 67735 140011e46 67726->67735 67736 140011e06 67726->67736 67742 1400183cc 99 API calls 67727->67742 67728->67712 67729->67740 67743 140011e68 67730->67743 67731 140011f51 67745 14000e684 _RunAllParam 100 API calls 67731->67745 67746 140015bf8 99 API calls 67732->67746 67733->67740 67760 140015bf8 99 API calls 67733->67760 67752 1400184b4 _RunAllParam 100 API calls 67734->67752 67750 140015bf8 99 API calls 67735->67750 67736->67747 67748 140011e1e 67736->67748 67787 140007fdc 67737->67787 67738->67740 67755 140015bf8 99 API calls 67738->67755 67739->67719 67740->67649 67773 14000b7c4 67740->67773 67741->67721 67741->67740 67749 140011af7 67741->67749 67742->67703 67751 14000e684 _RunAllParam 100 API calls 67743->67751 67744->67731 67744->67740 67753 140011f3c 67744->67753 67745->67740 67746->67724 67747->67700 67747->67740 67754 140015bf8 99 API calls 67748->67754 67756 140011bb1 67749->67756 67762 140011b00 67749->67762 67750->67703 67751->67740 67752->67740 67759 14000e684 _RunAllParam 100 API calls 67753->67759 67754->67740 67755->67740 67757 14000e684 _RunAllParam 100 API calls 67756->67757 67757->67740 67758->67740 67761 14000e684 _RunAllParam 100 API calls 67758->67761 67759->67740 67760->67740 67761->67740 67762->67740 67763 14000d0c4 99 API calls 67762->67763 67764 140011b30 67763->67764 67765 14000e6c8 99 API calls 67764->67765 67766 140011b40 67765->67766 67767 140011b5e 67766->67767 67768 140024340 Concurrency::details::ExternalContextBase::~ExternalContextBase RaiseException 67766->67768 67769 14000f9cc _RunAllParam 100 API calls 67767->67769 67768->67767 67769->67734 67775 14000b7fb 67773->67775 67777 14000b7ef CallWindowProcW 67773->67777 67775->67777 67778 14000b80f DefWindowProcW 67775->67778 67776 14000b838 67776->67649 67777->67776 67778->67776 67780 1400109c1 67779->67780 67782 14001097c 67779->67782 67781 14001a13c _DeleteExceptionPtr 89 API calls 67780->67781 67783 1400109d4 67781->67783 67782->67740 67784 1400109e1 67783->67784 67822 1400142f8 RaiseException _RunAllParam 67783->67822 67784->67782 67823 14000fcf0 101 API calls 2 library calls 67784->67823 67788 140007ff2 67787->67788 67789 140015a44 _RunAllParam 99 API calls 67788->67789 67792 140007ff7 67789->67792 67790 140008040 67824 14000e58c 67790->67824 67792->67790 67793 140008031 67792->67793 67829 140007c3c 67793->67829 67837 140007c78 67801->67837 67816->67674 67817->67681 67823->67782 67825 14001a13c _DeleteExceptionPtr 89 API calls 67824->67825 67826 14000e5a8 67825->67826 67827 14000e5b5 67826->67827 67833 1400142f8 RaiseException _RunAllParam 67826->67833 67830 140007c55 67829->67830 67831 140007c60 EndDialog 67829->67831 67834 14000e130 67830->67834 67835 14000e144 PostMessageW 67834->67835 67836 14000e15f 67834->67836 67835->67836 67836->67831 67850 14000dcac 67837->67850 67840 1400025d5 67842 1400024dc 67840->67842 67841 140007c3c 2 API calls 67841->67840 67843 1400024ff _itow 67842->67843 67853 1400134a0 67843->67853 67851 1400151fc _RunAllParam 89 API calls 67850->67851 67852 140007c8b 67851->67852 67852->67840 67852->67841 67854 1400134b5 67853->67854 67855 1400134aa SetDlgItemTextW 67853->67855 67855->67854 67857 14000820b 67856->67857 67858 1400081de 67856->67858 67860 140008210 LockResource 67857->67860 67864 14000821c 67857->67864 67859 140015a44 _RunAllParam 99 API calls 67858->67859 67861 1400081e3 FindResourceW LoadResource 67859->67861 67860->67864 67861->67857 67862 140008266 FreeResource 67863 14000826f 67862->67863 67863->67656 67865 14000dd34 67863->67865 67864->67862 67864->67863 67866 140013510 GetWindowLongW 67865->67866 67867 14000dd67 67866->67867 67868 14000dd71 67867->67868 67870 14000dd81 GetParent 67867->67870 67871 14000dd89 GetWindow 67867->67871 67869 14000ddb7 GetWindowRect 67868->67869 67873 14000dde8 67869->67873 67874 14000de9d GetParent GetClientRect GetClientRect MapWindowPoints 67869->67874 67872 14000dd94 67870->67872 67871->67872 67872->67869 67878 14000dd9c SendMessageW 67872->67878 67875 14000de01 67873->67875 67876 14000dded GetWindowLongW 67873->67876 67877 14000deda 67874->67877 67879 14000de65 GetWindowRect MonitorFromWindow GetMonitorInfoW 67875->67879 67880 14000de16 67875->67880 67876->67875 67883 140013868 SetWindowPos 67877->67883 67878->67869 67882 14000de8d CopyRect 67879->67882 67890 140005134 99 API calls _RunAllParam 67880->67890 67882->67877 67884 14000df78 67883->67884 67885 140154b40 _RunAllParam 8 API calls 67884->67885 67886 14000df84 67885->67886 67886->67656 67887 14000de1b MonitorFromWindow GetMonitorInfoW CopyRect 67887->67882 67890->67887 67891 1400459cc 67892 1400459f5 67891->67892 67893 1400459fc 67892->67893 67896 140045a41 67892->67896 67902 14003f058 PtInRect RaiseException _RunAllParam 67893->67902 67895 140045a03 67899 140045a3f 67895->67899 67903 140019408 RaiseException _RunAllParam 67895->67903 67896->67899 68006 1400c4314 89 API calls _DeleteExceptionPtr 67896->68006 67900 140045a1a 67900->67899 67904 14004472c 67900->67904 67902->67895 67903->67900 67908 140044775 67904->67908 67905 1400447b1 67906 1400447ba GetParent 67905->67906 67907 1400447fa 67905->67907 67909 14000e684 _RunAllParam 100 API calls 67906->67909 67910 14004487b 67907->67910 67917 1400447fe 67907->67917 67908->67905 67908->67906 68026 140041458 13 API calls _RunAllParam 67908->68026 67912 1400447cc 67909->67912 68007 14003f058 PtInRect RaiseException _RunAllParam 67910->68007 68027 140019474 67912->68027 67914 14004483b 67922 140044867 67914->67922 67923 14004485a SetCursor 67914->67923 67916 1400449cb 67920 140154b40 _RunAllParam 8 API calls 67916->67920 67917->67914 68032 140041458 13 API calls _RunAllParam 67917->68032 67925 140044e83 67920->67925 67921 1400447e0 GetParent 67926 14000e684 _RunAllParam 100 API calls 67921->67926 68033 1400c2fb8 91 API calls _DeleteExceptionPtr 67922->68033 67923->67922 67924 140044831 UpdateWindow 67924->67914 67925->67899 67930 1400447f2 67926->67930 67928 140044885 67928->67916 67929 1400448fc 67928->67929 67936 1400448c9 GetAsyncKeyState 67928->67936 67933 140044d67 67929->67933 67935 14004492c 67929->67935 68031 1400138e0 104 API calls _RunAllParam 67930->68031 67931 140044876 67931->67916 68041 14003f214 PtInRect RaiseException 67933->68041 67940 140044963 67935->67940 68034 140041458 13 API calls _RunAllParam 67935->68034 67936->67929 67938 1400448de 67936->67938 67937 140044d77 67939 140044d8f 67937->67939 68042 140019408 RaiseException _RunAllParam 67937->68042 67938->67929 67939->67916 68043 140041458 13 API calls _RunAllParam 67939->68043 68008 14003f058 PtInRect RaiseException _RunAllParam 67940->68008 67945 140044dae UpdateWindow 67947 140044dc8 67945->67947 67946 140044971 67948 14004498d 67946->67948 68035 1400142f8 RaiseException _RunAllParam 67946->68035 67950 140044e2b SetCapture 67947->67950 67958 140044ddc 67947->67958 67951 1400449d0 67948->67951 67952 1400449a9 67948->67952 67954 14000e684 _RunAllParam 100 API calls 67950->67954 68009 140041458 13 API calls _RunAllParam 67951->68009 67952->67916 68036 140041458 13 API calls _RunAllParam 67952->68036 67957 140044d56 67954->67957 67955 1400449da UpdateWindow 67959 1400449f1 67955->67959 67957->67916 68045 140041de4 106 API calls _RunAllParam 67957->68045 68044 140041458 13 API calls _RunAllParam 67958->68044 67964 140044a12 67959->67964 67965 140044a7a 67959->67965 67961 140044e62 RedrawWindow 67961->67916 67963 140044e1f UpdateWindow 67963->67957 67967 140044a4f SetCapture 67964->67967 67968 140044a3a InflateRect 67964->67968 67965->67957 68010 1400d8480 99 API calls 67965->68010 67970 14000e684 _RunAllParam 100 API calls 67967->67970 67968->67967 67969 140044ab3 68011 1400d88ec 67969->68011 67971 140044a61 SetCursor 67970->67971 67971->67957 68006->67899 68007->67928 68008->67946 68009->67955 68010->67969 68046 1400d87fc 68011->68046 68026->67905 68028 140019482 68027->68028 68029 14001948d 68027->68029 68057 140019408 RaiseException _RunAllParam 68028->68057 68029->67907 68029->67921 68032->67924 68033->67931 68034->67940 68036->67916 68041->67937 68042->67939 68043->67945 68044->67963 68045->67961 68047 140004cdc 99 API calls 68046->68047 68048 1400d8817 68047->68048 68049 1400213e4 _RunAllParam 6 API calls 68048->68049 68050 1400d8853 68049->68050 68051 1400d885c GetProfileIntW GetProfileIntW 68050->68051 68052 1400d88a6 68050->68052 68051->68052 68056 140021478 LeaveCriticalSection RaiseException _RunAllParam 68052->68056 68057->68029 68058 14015c584 68059 14015c5ac 68058->68059 68060 1401556ac malloc 61 API calls 68059->68060 68061 14015c5e4 68059->68061 68062 14015c5c0 Sleep 68059->68062 68060->68059 68062->68059 68062->68061 68063 140007ab8 68064 140007ae9 68063->68064 68065 140007ac4 68063->68065 68066 14000e6c8 99 API calls 68065->68066 68067 140007ac9 68066->68067 68068 140019474 _RunAllParam RaiseException 68067->68068 68069 140007ad8 68068->68069 68069->68064 68071 140001fb0 68069->68071 68107 14000812c 68071->68107 68075 14000209a SendMessageW SendMessageW SendMessageW 68076 140008ff0 SendMessageW 68075->68076 68078 14000210d 68076->68078 68077 140001fe8 _RunAllParam 68077->68075 68079 140002016 68077->68079 68081 1400011a8 _DeleteExceptionPtr 65 API calls 68077->68081 68080 140008ff0 SendMessageW 68078->68080 68084 140016910 99 API calls 68079->68084 68082 140002132 68080->68082 68081->68079 68083 140008ff0 SendMessageW 68082->68083 68085 140002153 68083->68085 68086 140002035 68084->68086 68087 140008ff0 SendMessageW 68085->68087 68088 14000204a 68086->68088 68090 140001898 69 API calls 68086->68090 68089 140002178 68087->68089 68092 140002055 AppendMenuW AppendMenuW 68088->68092 68093 14000207e 68088->68093 68091 140008ff0 SendMessageW 68089->68091 68090->68088 68094 14000219a 68091->68094 68092->68093 68093->68075 68095 140008ff0 SendMessageW 68094->68095 68096 1400021c0 68095->68096 68097 140001d04 127 API calls 68096->68097 68098 1400021c8 68097->68098 68099 1401556ac malloc 62 API calls 68098->68099 68102 1400021d4 _recalloc 68099->68102 68100 1400021f1 68101 140013428 GetDlgItem 68100->68101 68103 1400021fe 68101->68103 68102->68100 68104 140155564 free 62 API calls 68102->68104 68105 140013710 EnableWindow 68103->68105 68104->68100 68106 140002208 68105->68106 68106->68064 68108 140008141 68107->68108 68109 140008148 68107->68109 68128 140012cd8 407 API calls 2 library calls 68108->68128 68129 1400132ec 411 API calls _RunAllParam 68109->68129 68112 140008146 68113 14000815b 68112->68113 68115 14000dcac 89 API calls 68112->68115 68114 140007c3c 2 API calls 68113->68114 68116 140001fd4 GetSystemMenu 68114->68116 68117 14000816e 68115->68117 68125 140015bf8 68116->68125 68117->68113 68118 140008175 68117->68118 68130 140013428 68118->68130 68133 140015b54 99 API calls _RunAllParam 68125->68133 68127 140015c0b 68128->68112 68129->68112 68131 140013436 GetDlgItem 68130->68131 68132 14001344c 68130->68132 68131->68132 68133->68127 68134 1400332bc SetErrorMode SetErrorMode 68135 140015a44 _RunAllParam 99 API calls 68134->68135 68136 1400332ee 68135->68136 68148 140014e80 GetModuleFileNameW 68136->68148 68139 140015a44 _RunAllParam 99 API calls 68140 140033303 68139->68140 68141 140033325 68140->68141 68142 14003330c 68140->68142 68144 140015a44 _RunAllParam 99 API calls 68141->68144 68164 140032ff0 104 API calls 3 library calls 68142->68164 68145 14003332a 68144->68145 68146 140033335 68145->68146 68158 140005ac0 68145->68158 68149 140014f71 68148->68149 68150 140014eda 68148->68150 68151 140154b40 _RunAllParam 8 API calls 68149->68151 68152 140014ef1 CreateActCtxW 68150->68152 68153 140014ee3 SetLastError 68150->68153 68154 140014f96 68151->68154 68155 140014f31 CreateActCtxW 68152->68155 68156 140014f4c 68152->68156 68153->68149 68154->68139 68155->68156 68156->68149 68157 140014f56 CreateActCtxW 68156->68157 68157->68149 68159 140015a44 _RunAllParam 99 API calls 68158->68159 68160 140005acb 68159->68160 68161 140005af9 68160->68161 68162 1400151fc _RunAllParam 89 API calls 68160->68162 68161->68146 68163 140005ad6 GetCurrentThreadId SetWindowsHookExW 68162->68163 68163->68161 68164->68141 68165 140154cb0 68168 140154ba4 68165->68168 68167 140154cb9 68181 140155910 68168->68181 68170 140154bc5 DecodePointer DecodePointer 68171 140154bef 68170->68171 68172 140154c8a 68170->68172 68171->68172 68173 140156f4c _recalloc 63 API calls 68171->68173 68172->68167 68175 140154c0b 68173->68175 68174 140154c68 EncodePointer EncodePointer 68174->68172 68175->68174 68176 14015c688 66 API calls 68175->68176 68177 140154c2f 68175->68177 68176->68177 68177->68172 68178 140154c50 EncodePointer 68177->68178 68179 14015c688 66 API calls 68177->68179 68178->68174 68180 140154c4b 68179->68180 68180->68172 68180->68178 68182 14000429c 68183 1400042bf _RunAllParam 68182->68183 68184 1400042db 68183->68184 68185 1400011a8 _DeleteExceptionPtr 65 API calls 68183->68185 68186 140004316 malloc 68184->68186 68187 1400042f7 68184->68187 68185->68184 68193 140003e74 68186->68193 68224 140016910 68187->68224 68191 140004314 68194 140003ebb 68193->68194 68195 140003e9d 68193->68195 68197 140003eca 68194->68197 68199 1400011a8 _DeleteExceptionPtr 65 API calls 68194->68199 68243 140001678 65 API calls _DeleteExceptionPtr 68195->68243 68200 140003eea 68197->68200 68201 1400011a8 _DeleteExceptionPtr 65 API calls 68197->68201 68198 140003ea2 68198->68191 68199->68197 68202 140003f06 68200->68202 68239 1400016e8 68200->68239 68201->68200 68204 140003f27 68202->68204 68205 140003f1c 68202->68205 68245 140155198 62 API calls 4 library calls 68204->68245 68244 140155f6c 62 API calls 3 library calls 68205->68244 68208 140003f25 68208->68198 68209 1400011a8 _DeleteExceptionPtr 65 API calls 68208->68209 68210 140003f51 68209->68210 68211 1400011a8 _DeleteExceptionPtr 65 API calls 68210->68211 68213 140003f99 wcsnlen 68210->68213 68211->68213 68212 140003fc8 68215 140003fdc 68212->68215 68216 1400011a8 _DeleteExceptionPtr 65 API calls 68212->68216 68213->68212 68214 1400011a8 _DeleteExceptionPtr 65 API calls 68213->68214 68214->68212 68217 140003ffb 68215->68217 68218 1400016e8 _RunAllParam 65 API calls 68215->68218 68216->68215 68246 140155198 62 API calls 4 library calls 68217->68246 68218->68217 68220 14000401c 68221 140004025 68220->68221 68222 1400011a8 _DeleteExceptionPtr 65 API calls 68220->68222 68221->68191 68223 14000405d 68222->68223 68225 140015a44 _RunAllParam 99 API calls 68224->68225 68226 140004301 68225->68226 68226->68191 68227 140001898 FindResourceW 68226->68227 68228 1400018e2 68227->68228 68229 140001941 68227->68229 68248 1400011c0 LoadResource LockResource SizeofResource 68228->68248 68229->68191 68231 1400018f0 68231->68229 68232 140001909 68231->68232 68233 1400011a8 _DeleteExceptionPtr 65 API calls 68231->68233 68234 140001926 68232->68234 68235 1400016e8 _RunAllParam 65 API calls 68232->68235 68233->68232 68249 140001364 63 API calls 4 library calls 68234->68249 68235->68234 68237 140001938 68237->68229 68238 1400011a8 _DeleteExceptionPtr 65 API calls 68237->68238 68238->68229 68241 140001703 68239->68241 68240 140001741 68240->68202 68241->68240 68247 1400014f4 65 API calls _RunAllParam 68241->68247 68243->68198 68244->68208 68245->68208 68246->68220 68247->68240 68248->68231 68249->68237 68250 140011140 GetPropW 68251 1400111b3 68250->68251 68252 140011296 68250->68252 68253 1400111bc 68251->68253 68254 14001126d 68251->68254 68255 14000e684 _RunAllParam 100 API calls 68252->68255 68257 1400111c1 68253->68257 68258 140011234 SetWindowLongPtrW RemovePropW GlobalFindAtomW GlobalDeleteAtom 68253->68258 68256 14000e684 _RunAllParam 100 API calls 68254->68256 68259 14001129e 68255->68259 68261 140011275 68256->68261 68260 1400112c0 CallWindowProcW 68257->68260 68262 1400111cd 68257->68262 68258->68260 68263 14000e684 _RunAllParam 100 API calls 68259->68263 68266 14001122f 68260->68266 68278 1400110bc 108 API calls _RunAllParam 68261->68278 68264 14000e684 _RunAllParam 100 API calls 68262->68264 68265 1400112a9 68263->68265 68268 1400111e5 68264->68268 68279 140011018 107 API calls 68265->68279 68272 140154b40 _RunAllParam 8 API calls 68266->68272 68277 14000d224 GetWindowRect GetWindowLongW 68268->68277 68270 14001128c 68270->68260 68270->68266 68275 1400112f4 68272->68275 68274 1400111fd CallWindowProcW 68276 14000f718 125 API calls 68274->68276 68276->68266 68277->68274 68278->68270 68279->68270 68280 140004a00 68281 140004a67 68280->68281 68282 140004a2a 68280->68282 68284 140004af2 68281->68284 68285 140004a70 68281->68285 68283 140015a44 _RunAllParam 99 API calls 68282->68283 68286 140004a2f 68283->68286 68292 140004a41 68284->68292 68293 14000487c 68284->68293 68285->68292 68318 1400142f8 RaiseException _RunAllParam 68285->68318 68287 140004a3b 68286->68287 68317 1400142f8 RaiseException _RunAllParam 68286->68317 68290 140015a44 _RunAllParam 99 API calls 68287->68290 68290->68292 68294 140004893 68293->68294 68295 14000488e 68293->68295 68297 140004964 68294->68297 68298 1400048be 68294->68298 68313 1400048a3 68294->68313 68325 1400142f8 RaiseException _RunAllParam 68295->68325 68301 1400049d5 68297->68301 68302 14000496a 68297->68302 68299 1400048c4 68298->68299 68300 140004945 68298->68300 68303 14000493d 68299->68303 68310 1400048ca 68299->68310 68300->68313 68328 1400142f8 RaiseException _RunAllParam 68300->68328 68301->68313 68331 1400142f8 RaiseException _RunAllParam 68301->68331 68304 1400049b1 68302->68304 68305 14000496f 68302->68305 68319 140001b30 68303->68319 68304->68313 68330 1400142f8 RaiseException _RunAllParam 68304->68330 68305->68313 68329 1400142f8 RaiseException _RunAllParam 68305->68329 68311 140004906 68310->68311 68312 1400048de 68310->68312 68310->68313 68311->68313 68327 1400142f8 RaiseException _RunAllParam 68311->68327 68312->68313 68326 1400142f8 RaiseException _RunAllParam 68312->68326 68313->68292 68320 140001b42 _RunAllParam 68319->68320 68321 140001b5b 68320->68321 68322 1400011a8 _DeleteExceptionPtr 65 API calls 68320->68322 68332 140001290 68321->68332 68322->68321 68324 140001b7a _cwprintf_s_l 68324->68313 68333 1400012b4 68332->68333 68344 140002bfc 68333->68344 68336 1400012e0 68336->68324 68338 1400012d3 68339 1400012d8 68338->68339 68340 1400012eb 68338->68340 68359 140002b4c 66 API calls free 68339->68359 68360 140002b4c 66 API calls free 68340->68360 68343 1400012fb ExitProcess 68345 140002c21 68344->68345 68347 1400012c0 68344->68347 68346 140002c34 VirtualAlloc 68345->68346 68345->68347 68348 140002c75 GetProcessHeap HeapAlloc VirtualAlloc 68346->68348 68349 140002c57 VirtualAlloc 68346->68349 68347->68336 68358 140002a9c 62 API calls 68347->68358 68350 140002cc9 wmemcpy_s 68348->68350 68349->68347 68349->68348 68361 1400026c4 68350->68361 68352 140002ce5 68366 140002948 68352->68366 68355 140002d0a 68355->68347 68381 140002b4c 66 API calls free 68355->68381 68358->68338 68359->68336 68360->68343 68362 140002790 68361->68362 68365 140002706 wmemcpy_s _recalloc 68361->68365 68362->68352 68363 140002749 VirtualAlloc 68363->68365 68364 140002717 VirtualAlloc 68364->68365 68365->68362 68365->68363 68365->68364 68367 140002981 IsBadReadPtr 68366->68367 68368 140002a7a 68366->68368 68367->68368 68369 14000299e 68367->68369 68368->68355 68376 1400027b0 68368->68376 68369->68368 68370 1400029ac LoadLibraryA 68369->68370 68371 140002a76 68370->68371 68373 1400029c4 68370->68373 68371->68368 68373->68368 68373->68371 68374 140002a5b IsBadReadPtr 68373->68374 68375 140002a38 GetProcAddress 68373->68375 68382 1401557e8 68373->68382 68374->68369 68374->68371 68375->68373 68377 14000289c 68376->68377 68379 1400027ef 68376->68379 68377->68355 68378 140002813 VirtualFree 68378->68379 68379->68377 68379->68378 68380 14000286f VirtualProtect 68379->68380 68380->68379 68381->68347 68383 140155802 68382->68383 68384 14015580c 68382->68384 68385 1401556ac malloc 62 API calls 68383->68385 68386 140155811 68384->68386 68397 140155818 68384->68397 68401 14015580a realloc 68385->68401 68402 140155564 68386->68402 68388 140155861 68409 14015e2a0 DecodePointer 68388->68409 68389 14015581e RtlReAllocateHeap 68389->68397 68389->68401 68391 14015589f 68393 140156050 _errno 62 API calls 68391->68393 68392 140155869 68395 140156050 _errno 62 API calls 68392->68395 68396 1401558a4 GetLastError 68393->68396 68395->68401 68396->68401 68397->68388 68397->68389 68397->68391 68398 140155886 68397->68398 68408 14015e2a0 DecodePointer 68397->68408 68399 140156050 _errno 62 API calls 68398->68399 68400 14015588b GetLastError 68399->68400 68400->68401 68401->68373 68403 140155569 RtlDeleteBoundaryDescriptor 68402->68403 68405 140155599 realloc 68402->68405 68404 140155584 68403->68404 68403->68405 68406 140156050 _errno 60 API calls 68404->68406 68405->68401 68407 140155589 GetLastError 68406->68407 68407->68405 68408->68397 68409->68392 68410 18000a840 68413 18000a440 GetModuleFileNameA 68410->68413 68412 18000a849 ExitProcess 68414 18000a4b1 68413->68414 68419 18000a767 68414->68419 68421 1800020e0 memchr std::_Xbad_alloc 68414->68421 68416 18000a715 68416->68419 68422 18000c0a0 GetSystemTimeAsFileTime 68416->68422 68418 18000a75a 68423 1800090c0 68418->68423 68419->68412 68421->68416 68422->68418 68458 180008a80 GetModuleFileNameA 68423->68458 68425 180009101 68462 180008030 68425->68462 68427 180009126 68471 1800085e0 SHGetSpecialFolderLocation 68427->68471 68429 180009149 68475 1800086a0 SHGetSpecialFolderLocation 68429->68475 68431 1800092af 68432 1800085e0 2 API calls 68431->68432 68433 180009300 68432->68433 68479 1800081a0 68433->68479 68435 1800093d1 SetFileAttributesW 68436 18000940d 68435->68436 68483 1800083b0 CoInitialize 68436->68483 68438 180009652 68439 1800097db Sleep 68438->68439 68440 1800083b0 CoInitialize 68439->68440 68441 180009860 68440->68441 68442 1800083b0 CoInitialize 68441->68442 68443 1800098c1 setSBCS 68442->68443 68444 1800098d3 ShellExecuteExW Sleep DeleteFileW 68443->68444 68445 180009988 68444->68445 68485 1800088e0 68445->68485 68447 180009a50 68448 1800083b0 CoInitialize 68447->68448 68450 180009acc 68448->68450 68449 1800088e0 8 API calls 68451 180009cc6 ShellExecuteW Sleep DeleteFileW DeleteFileW DeleteFileW 68449->68451 68450->68449 68452 180009dbd 68451->68452 68499 180002d40 68452->68499 68454 180009de1 Sleep DeleteFileW DeleteFileW DeleteFileW Sleep 68511 18000e500 68454->68511 68457 180009f09 68457->68419 68459 180008b08 68458->68459 68461 180008c1f 68459->68461 68513 1800020e0 memchr std::_Xbad_alloc 68459->68513 68461->68425 68463 18000808e 68462->68463 68467 180008075 68462->68467 68514 180002650 std::_Xbad_alloc setSBCS 68463->68514 68465 180008096 rand 68465->68467 68466 180008141 rand 68466->68467 68467->68465 68467->68466 68468 18000810c rand 68467->68468 68469 180008176 68467->68469 68470 1800080d5 rand 68467->68470 68468->68467 68469->68427 68470->68467 68472 18000e500 setSBCS 68471->68472 68473 18000862f SHGetPathFromIDListW 68472->68473 68474 180008655 68473->68474 68474->68429 68476 18000e500 setSBCS 68475->68476 68477 1800086ef SHGetPathFromIDListW 68476->68477 68478 180008715 68477->68478 68478->68431 68480 1800081e7 68479->68480 68481 1800082fe 68480->68481 68515 1800078d0 68480->68515 68481->68435 68484 1800083f7 68483->68484 68484->68438 68486 180008905 68485->68486 68490 1800089c9 68485->68490 68487 18000890e PathFileExistsW 68486->68487 68486->68490 68488 180008925 CreateFileW 68487->68488 68489 18000895d CreateFileW 68487->68489 68488->68489 68491 180008954 CloseHandle 68488->68491 68489->68490 68492 180008993 WideCharToMultiByte 68489->68492 68490->68447 68491->68489 68492->68490 68493 1800089ef 68492->68493 68494 1800089fc WideCharToMultiByte 68493->68494 68495 180008a27 68494->68495 68495->68495 68496 180008a30 WriteFile 68495->68496 68497 18000b914 68496->68497 68498 180008a51 CloseHandle 68497->68498 68498->68490 68500 180002d95 68499->68500 68585 180002bc0 RtlpNtOpenKey 68500->68585 68502 180002dba 68503 180002bc0 RtlpNtOpenKey 68502->68503 68505 180002dd5 68502->68505 68503->68505 68504 180002de7 68504->68454 68505->68504 68505->68505 68506 180002ed4 CoGetObject 68505->68506 68508 180002f02 68505->68508 68506->68508 68507 18000301e 68507->68504 68509 180003033 Sleep 68507->68509 68508->68504 68508->68507 68508->68508 68510 180002ff7 CoGetObject 68508->68510 68509->68504 68510->68507 68512 180009e5d ShellExecuteExW DeleteFileW DeleteFileW DeleteFileW 68511->68512 68512->68457 68513->68461 68514->68465 68516 1800078fc 68515->68516 68518 18000792f 68516->68518 68525 180007913 68516->68525 68554 1800065b0 SetFilePointer 68516->68554 68519 180007958 68518->68519 68523 180007995 68518->68523 68519->68518 68555 180006140 SetFilePointer 68519->68555 68521 180007a66 68522 180007ab4 wsprintfW 68521->68522 68526 180007b05 68522->68526 68523->68521 68523->68522 68524 180007ae6 wsprintfW 68523->68524 68523->68525 68524->68526 68525->68480 68527 180007b12 CreateFileW 68526->68527 68528 180007b4c 68527->68528 68536 1800068c0 68528->68536 68530 180007b65 68533 180007ba7 WriteFile 68530->68533 68534 180007bd6 68530->68534 68535 180007be4 SetFileTime 68530->68535 68550 180006ae0 68530->68550 68532 180007c0c CloseHandle 68532->68525 68533->68530 68533->68534 68534->68532 68535->68532 68537 1800068d2 68536->68537 68538 1800068de 68536->68538 68537->68530 68538->68537 68577 180006600 SetFilePointer 68538->68577 68540 18000690a 68541 18000690e 68540->68541 68556 18000b69c 68540->68556 68541->68530 68544 180006931 68544->68530 68545 18000b69c malloc 34 API calls 68546 18000694f 68545->68546 68549 180006986 68546->68549 68571 18000b65c 68546->68571 68548 180006972 68548->68530 68549->68530 68553 180006af8 68550->68553 68551 180006b00 68551->68530 68552 180006bde SetFilePointer 68552->68553 68553->68551 68553->68552 68554->68518 68555->68519 68557 18000b730 _callnewh 68556->68557 68562 18000b6b4 68556->68562 68583 18000e164 _getptd_noexit 68557->68583 68559 18000b6ec RtlAllocateHeap 68561 180006929 68559->68561 68559->68562 68560 18000b6cc 68560->68559 68578 18000e200 28 API calls 2 library calls 68560->68578 68579 18000e274 28 API calls 3 library calls 68560->68579 68580 18000c144 GetModuleHandleExW GetProcAddress ExitProcess __crtCorExitProcess 68560->68580 68561->68544 68561->68545 68562->68559 68562->68560 68564 18000b715 68562->68564 68565 18000b707 _callnewh 68562->68565 68581 18000e164 _getptd_noexit 68564->68581 68565->68562 68568 18000b71a 68565->68568 68582 18000e164 _getptd_noexit 68568->68582 68572 18000b661 HeapFree 68571->68572 68573 18000b691 _dosmaperr 68571->68573 68572->68573 68574 18000b67c 68572->68574 68573->68548 68584 18000e164 _getptd_noexit 68574->68584 68576 18000b681 GetLastError 68576->68573 68577->68540 68578->68560 68579->68560 68581->68568 68582->68561 68583->68561 68584->68576 68586 180002c4c 68585->68586 68586->68502 68587 18000c380 RtlEncodePointer 68588 18000dd58 68587->68588 68589 18000c399 68588->68589 68590 18000c3a9 _initp_misc_winsig 68589->68590 68591 18000c3b9 68590->68591 68592 18000ff24 34 API calls 68591->68592

                      Executed Functions

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 0 1800090c0-180009107 call 180008a80 3 180009109 0->3 4 18000910c-18000912c call 180007e80 call 180008030 0->4 3->4 9 180009131-18000919a call 180007e80 call 1800085e0 call 18000a8f0 call 18000a9b0 call 18000a8f0 call 18000a9b0 4->9 10 18000912e 4->10 23 1800091a5-1800091bc 9->23 24 18000919c-1800091a0 call 18000b58c 9->24 10->9 25 1800091c7-1800091dc 23->25 26 1800091be-1800091c2 call 18000b58c 23->26 24->23 29 1800091e7-1800091fc 25->29 30 1800091de-1800091e2 call 18000b58c 25->30 26->25 32 180009207-18000921c 29->32 33 1800091fe-180009202 call 18000b58c 29->33 30->29 35 180009227-18000923c 32->35 36 18000921e-180009222 call 18000b58c 32->36 33->32 38 180009248-18000925f 35->38 39 18000923e-180009243 call 18000b58c 35->39 36->35 41 180009261-180009266 call 18000b58c 38->41 42 18000926b-180009284 38->42 39->38 41->42 44 180009286-18000928b call 18000b58c 42->44 45 180009290-1800092cf call 1800086a0 call 18000a8f0 42->45 44->45 51 1800092d1-1800092d8 call 18000b58c 45->51 52 1800092dd-18000931e call 1800085e0 call 18000a8f0 45->52 51->52 58 18000932a-1800094cd call 180008850 call 180001410 call 180001980 call 1800081a0 SetFileAttributesW call 180002860 call 180008850 call 180001830 call 180002860 * 2 call 18000aaa0 call 18000a8f0 52->58 59 180009320-180009325 call 18000b58c 52->59 83 1800094db-18000952a call 18000aaa0 call 18000a8f0 58->83 84 1800094cf-1800094d6 call 18000b58c 58->84 59->58 90 180009536-1800096ec call 180002860 * 7 call 1800083b0 call 180002860 * 2 call 18000aaa0 call 18000a8f0 call 18000ab90 call 18000a8f0 83->90 91 18000952c-180009531 call 18000b58c 83->91 84->83 121 1800096fa-180009719 90->121 122 1800096ee-1800096f5 call 18000b58c 90->122 91->90 124 180009725-18000973e 121->124 125 18000971b-180009720 call 18000b58c 121->125 122->121 127 18000974a-1800097cd call 180002860 * 2 call 18000aaa0 call 18000a8f0 124->127 128 180009740-180009745 call 18000b58c 124->128 125->124 138 1800097db-1800099f6 Sleep call 1800083b0 * 2 call 18000e500 ShellExecuteExW Sleep DeleteFileW call 180002860 call 180001830 call 180002860 call 18000ab90 127->138 139 1800097cf-1800097d6 call 18000b58c 127->139 128->127 155 180009a04-180009b32 call 1800088e0 call 18000aaa0 call 1800083b0 call 18000aaa0 call 18000a8f0 call 18000aaa0 call 18000a9b0 138->155 156 1800099f8-1800099ff call 18000b58c 138->156 139->138 172 180009b34-180009b3b call 18000b58c 155->172 173 180009b40-180009b5f 155->173 156->155 172->173 175 180009b61-180009b66 call 18000b58c 173->175 176 180009b6b-180009b84 173->176 175->176 178 180009b86-180009b8b call 18000b58c 176->178 179 180009b90-180009c16 call 18000aaa0 call 18000a8f0 call 180002860 call 18000ab90 call 18000a9b0 176->179 178->179 191 180009c22-180009c38 179->191 192 180009c18-180009c1d call 18000b58c 179->192 194 180009c43-180009c58 191->194 195 180009c3a-180009c3e call 18000b58c 191->195 192->191 197 180009c63-180009c78 194->197 198 180009c5a-180009c5e call 18000b58c 194->198 195->194 200 180009c83-180009f04 call 1800088e0 ShellExecuteW Sleep DeleteFileW * 3 call 1800030f0 call 180002d40 Sleep DeleteFileW * 3 Sleep call 18000e500 ShellExecuteExW DeleteFileW * 3 call 18000b914 197->200 201 180009c7a-180009c7e call 18000b58c 197->201 198->197 212 180009f09-180009f12 200->212 201->200 213 180009f14-180009f1b call 18000b58c 212->213 214 180009f20-180009f41 212->214 213->214 216 180009f43-180009f4a call 18000b58c 214->216 217 180009f4f-180009f70 214->217 216->217 218 180009f72-180009f79 call 18000b58c 217->218 219 180009f7e-180009f9f 217->219 218->219 222 180009fa1-180009fa8 call 18000b58c 219->222 223 180009fad-180009fce 219->223 222->223 225 180009fdc-180009ffd 223->225 226 180009fd0-180009fd7 call 18000b58c 223->226 228 18000a00b-18000a02c 225->228 229 180009fff-18000a006 call 18000b58c 225->229 226->225 231 18000a03a-18000a05b 228->231 232 18000a02e-18000a035 call 18000b58c 228->232 229->228 233 18000a069-18000a08a 231->233 234 18000a05d-18000a064 call 18000b58c 231->234 232->231 237 18000a098-18000a0b9 233->237 238 18000a08c-18000a093 call 18000b58c 233->238 234->233 240 18000a0c7-18000a0e8 237->240 241 18000a0bb-18000a0c2 call 18000b58c 237->241 238->237 243 18000a0f6-18000a117 240->243 244 18000a0ea-18000a0f1 call 18000b58c 240->244 241->240 246 18000a125-18000a146 243->246 247 18000a119-18000a120 call 18000b58c 243->247 244->243 249 18000a154-18000a175 246->249 250 18000a148-18000a14f call 18000b58c 246->250 247->246 252 18000a183-18000a1a4 249->252 253 18000a177-18000a17e call 18000b58c 249->253 250->249 255 18000a1b2-18000a1d3 252->255 256 18000a1a6-18000a1ad call 18000b58c 252->256 253->252 258 18000a1e1-18000a202 255->258 259 18000a1d5-18000a1dc call 18000b58c 255->259 256->255 261 18000a204-18000a20b call 18000b58c 258->261 262 18000a210-18000a231 258->262 259->258 261->262 264 18000a233-18000a23a call 18000b58c 262->264 265 18000a23f-18000a260 262->265 264->265 266 18000a262-18000a269 call 18000b58c 265->266 267 18000a26e-18000a28f 265->267 266->267 270 18000a291-18000a298 call 18000b58c 267->270 271 18000a29d-18000a2be 267->271 270->271 273 18000a2cc-18000a2ed 271->273 274 18000a2c0-18000a2c7 call 18000b58c 271->274 276 18000a2fb-18000a31c 273->276 277 18000a2ef-18000a2f6 call 18000b58c 273->277 274->273 279 18000a32a-18000a34b 276->279 280 18000a31e-18000a325 call 18000b58c 276->280 277->276 281 18000a359-18000a37a 279->281 282 18000a34d-18000a354 call 18000b58c 279->282 280->279 285 18000a388-18000a3a9 281->285 286 18000a37c-18000a383 call 18000b58c 281->286 282->281 288 18000a3b7-18000a3d8 285->288 289 18000a3ab-18000a3b2 call 18000b58c 285->289 286->285 291 18000a3e6-18000a407 288->291 292 18000a3da-18000a3e1 call 18000b58c 288->292 289->288 294 18000a415-18000a43e call 18000ae60 291->294 295 18000a409-18000a410 call 18000b58c 291->295 292->291 295->294
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: File$Delete$AddressProcSleep$ExecuteShell$Module$AttributesHandleInitializeName
                      • String ID: -y$ /c $ x $"$" "$111.7z$C:\Windows\System32\cmd.exe$URL=file:///$[InternetShortcut]$\111.7z$\111.7z"$\Microsoft\$\PMRunner64.exe$\TXP\*$\TXP\Windows\Start Menu\Programs\Startup$\TXP\Windows\Start Menu\Programs\Startup\Realtek$\copy.bat$\ru2.url$\run.lnk$\run001.lnk$\run002.lnk$\run003.lnk$\zr.exe$\zr.exe"$a "$copy $runas$zr.exe
                      • API String ID: 1447988764-2956462178
                      • Opcode ID: 0b7d18145ae30151f17328b5e1a2a75291c60442eb6ff8648fb8f4eb0540d4f5
                      • Instruction ID: 93b6c1ea5101e8c75e4868764a802d8d76c1f54b48229b35d8eeac1166df4d8b
                      • Opcode Fuzzy Hash: 0b7d18145ae30151f17328b5e1a2a75291c60442eb6ff8648fb8f4eb0540d4f5
                      • Instruction Fuzzy Hash: C7B2F532215AC9D9EBB2DF60DC983CD33A5FB4938CF508126E6494AAA9DF748748C744
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 389 14002007c-140020109 call 140018580 GetDeviceCaps 392 14002010b-140020117 389->392 393 14002012a-140020137 389->393 392->393 394 140020119-140020123 392->394 395 140020139-14002013d 393->395 396 140020150-14002015a 393->396 394->393 395->396 397 14002013f-14002014a call 1400187cc DeleteObject 395->397 398 140020173-14002017d 396->398 399 14002015c-140020160 396->399 397->396 400 140020196-1400201a0 398->400 401 14002017f-140020183 398->401 399->398 403 140020162-14002016d call 1400187cc DeleteObject 399->403 405 1400201a2-1400201a6 400->405 406 1400201b9-1400201c3 400->406 401->400 404 140020185-140020190 call 1400187cc DeleteObject 401->404 403->398 404->400 405->406 411 1400201a8-1400201b3 call 1400187cc DeleteObject 405->411 412 1400201c5-1400201c9 406->412 413 1400201dc-1400201e6 406->413 411->406 412->413 418 1400201cb-1400201d6 call 1400187cc DeleteObject 412->418 414 1400201e8-1400201ec 413->414 415 1400201ff-140020209 413->415 414->415 419 1400201ee-1400201f9 call 1400187cc DeleteObject 414->419 420 140020223-14002022d 415->420 421 14002020b-140020210 415->421 418->413 419->415 426 140020246-140020250 420->426 427 14002022f-140020233 420->427 421->420 425 140020212-14002021d call 1400187cc DeleteObject 421->425 425->420 429 140020252-140020256 426->429 430 140020269-140020273 426->430 427->426 433 140020235-140020240 call 1400187cc DeleteObject 427->433 429->430 434 140020258-140020263 call 1400187cc DeleteObject 429->434 435 140020275-14002027a 430->435 436 14002028d-1400202e5 call 14001e628 call 1401555c0 GetTextCharsetInfo 430->436 433->426 434->430 435->436 440 14002027c-140020287 call 1400187cc DeleteObject 435->440 449 1400202e7-1400202ec 436->449 450 1400202ee 436->450 440->436 451 1400202f0-140020313 lstrcpyW 449->451 450->451 452 140020315-14002031c 451->452 453 14002038e-1400203d5 CreateFontIndirectW call 140018790 call 140157bc8 451->453 452->453 454 14002031e-14002033b EnumFontFamiliesW 452->454 463 1400203d7-1400203d9 453->463 464 1400203dd-140020506 CreateFontIndirectW call 140018790 call 14001e628 CreateFontIndirectW call 140018790 CreateFontIndirectW call 140018790 CreateFontIndirectW call 140018790 GetSystemMetrics lstrcpyW CreateFontIndirectW call 140018790 GetStockObject 453->464 456 140020356-14002037f EnumFontFamiliesW 454->456 457 14002033d-140020354 lstrcpyW 454->457 459 140020381 456->459 460 140020388 lstrcpyW 456->460 457->453 459->460 460->453 463->464 477 140020593-140020607 GetStockObject call 14001876c GetObjectW CreateFontIndirectW call 140018790 CreateFontIndirectW call 140018790 call 14001e6ec 464->477 478 14002050c-140020520 GetObjectW 464->478 491 14002063f-140020642 477->491 478->477 480 140020522-14002058e lstrcpyW CreateFontIndirectW call 140018790 CreateFontIndirectW call 140018790 478->480 480->477 492 140020644 491->492 493 140020609-14002060f 491->493 494 140020652-140020663 call 140009af8 492->494 495 140020611-140020623 493->495 496 14002064c-140020651 call 1400142f8 493->496 503 140020668-1400206a7 call 1400185e4 call 140154b40 494->503 499 140020625-140020631 call 14000e6c8 495->499 500 140020646-14002064b call 1400142f8 495->500 496->494 499->491 509 140020633-140020636 499->509 500->496 509->491
                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object$Font$CreateDeleteIndirect$lstrcpy$EnumFamiliesStock$CapsCharsetDeviceInfoMetricsSystemTextWindow
                      • String ID:
                      • API String ID: 3508414979-0
                      • Opcode ID: 6e20358c550147889875c32589333509f05a43fb427871e5c131736143bd45e8
                      • Instruction ID: ba0818e02d43f36292fe1763b5b1dc41ae99007347e22566d4449ffcd63f51a3
                      • Opcode Fuzzy Hash: 6e20358c550147889875c32589333509f05a43fb427871e5c131736143bd45e8
                      • Instruction Fuzzy Hash: AA029132205B8186EB16DB27E4587DE73A5FB8CB80F54412AEB4A477B6DF38CA55C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressProc$MetricsSystemVersion
                      • String ID: 2$BeginBufferedPaint$BufferedPaintInit$BufferedPaintUnInit$DrawThemeParentBackground$DrawThemeTextEx$DwmDefWindowProc$DwmExtendFrameIntoClientArea$DwmIsCompositionEnabled$EndBufferedPaint$UxTheme.dll$dwmapi.dll
                      • API String ID: 1222729687-1204417773
                      • Opcode ID: 640cb516b391a9670892f916f81da503ebf25ab51b1c1c0c5dd2ccf9962feaeb
                      • Instruction ID: 0b87f6db654519b9e357d8e4bbde514ea029f2e38b1e6f5a1e06d387e5297a55
                      • Opcode Fuzzy Hash: 640cb516b391a9670892f916f81da503ebf25ab51b1c1c0c5dd2ccf9962feaeb
                      • Instruction Fuzzy Hash: 4EB17232102B8085D782CF25E9883C973E8F758F88F68423ADA994B7B4DF758566C750
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: IoctlSocketStartupbindgethostbynamegethostnamehtonsinet_ntoa
                      • String ID: ($WSAStartup() failed !
                      • API String ID: 869787016-1840855788
                      • Opcode ID: a1724c3947eac58366e16062bc919f93eab0225298c8d248ad04712b7f06633c
                      • Instruction ID: abde9fe847369afca694e80603aa4d59ef7abe8d1995be759e01ea42c053a72f
                      • Opcode Fuzzy Hash: a1724c3947eac58366e16062bc919f93eab0225298c8d248ad04712b7f06633c
                      • Instruction Fuzzy Hash: D0614972210A85C6E711DF26E8443DE73A1F788BA8F504226EB6943BF9DF78C944CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 602 180002d40-180002dc3 call 1800192e0 call 180002bc0 607 180002df1-180002dfc call 180002d00 602->607 608 180002dc5-180002dd7 call 180002bc0 602->608 613 180002e08-180002e20 607->613 614 180002dfe-180002e03 607->614 608->607 615 180002dd9-180002dde 608->615 617 180002e22-180002e29 613->617 616 180003099-1800030c6 614->616 618 180002de7-180002dec 615->618 619 180002de0-180002de5 615->619 620 1800030c8 call 1800192f8 616->620 621 1800030ce-1800030e8 call 18000ae60 616->621 617->617 622 180002e2b-180002e3f 617->622 618->616 619->607 619->618 620->621 625 180002f02 622->625 626 180002e45-180002e78 622->626 627 180002f04-180002f06 625->627 629 180002e80-180002e92 626->629 630 180003068 627->630 631 180002f0c-180002f0f 627->631 629->629 632 180002e94-180002ea1 629->632 635 18000306d-180003070 630->635 633 180002f15-180002f3f 631->633 634 18000308c 631->634 636 180002ea3-180002eaa 632->636 637 180002eac-180002eb6 632->637 633->630 645 180002f45-180002f4d 633->645 641 180003091 634->641 638 180003072-180003075 635->638 639 18000307b-18000307e 635->639 636->636 636->637 640 180002ec0-180002ed2 637->640 638->639 639->641 643 180003080-18000308a 639->643 640->640 644 180002ed4-180002f00 CoGetObject 640->644 641->616 643->641 644->627 646 180002f50-180002f58 645->646 646->646 648 180002f5a-180002f64 646->648 649 180002f6a-180002f9d 648->649 650 18000301e-180003020 648->650 652 180002fa0-180002fb5 649->652 650->630 651 180003022-180003025 650->651 651->630 653 180003027-180003060 Sleep 651->653 652->652 654 180002fb7-180002fce 652->654 660 180003066 653->660 655 180002fda-180002fdd 654->655 656 180002fd0-180002fd8 654->656 658 180002fe0-180002ff5 655->658 656->655 656->656 658->658 659 180002ff7-18000301c CoGetObject 658->659 659->650 660->635
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object$OpenRtlpSleep
                      • String ID: 0$DisplayCalibrator$Elevation:Administrator!new:$Software\Microsoft\Windows NT\CurrentVersion\ICM\Calibration${3E5FC7F9-9A51-4367-9063-A120244FBEC7}${D2E7041B-2927-42fb-8E9F-7CE93B6DC937}
                      • API String ID: 145628415-2722874554
                      • Opcode ID: 71c1ed6a255fbbc55cbc742e89c039c3efaa5b5e8a4c4d05442f49652f36c115
                      • Instruction ID: 3d22a9c014b2c50595b803851a73d9406be8ec9c41fdbb561083845071600a94
                      • Opcode Fuzzy Hash: 71c1ed6a255fbbc55cbc742e89c039c3efaa5b5e8a4c4d05442f49652f36c115
                      • Instruction Fuzzy Hash: CFA1AC32201B8986EBA2CF65D4543EE73B5F788BC4F958026EA4E57794DF39C64AC700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: File$ByteCharCloseCreateHandleMultiWide$ExistsPathWrite
                      • String ID:
                      • API String ID: 3442908436-0
                      • Opcode ID: ac78027ac64b0131ad8d5dfb6cd97fbb9e766a431a12132b64382382f9cf3557
                      • Instruction ID: f9c5d8892a1a710cfd8f56384370cc769670959436ea0070a1bd9b4e451b01c3
                      • Opcode Fuzzy Hash: ac78027ac64b0131ad8d5dfb6cd97fbb9e766a431a12132b64382382f9cf3557
                      • Instruction Fuzzy Hash: 0A417332208B4486E7A1DB61B45439AB7E4FB8DBE4F448714FEE903B94DF38C2599B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _itow$MetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
                      • String ID:
                      • API String ID: 3149539040-0
                      • Opcode ID: 1f52d9892fc033aacd12757219a004e32a9f7d8e2f55fffd1daee766a8be0e4a
                      • Instruction ID: 3c1b81e64eed35604fa1b727d889692916ab584ce914eb87054886437c589e36
                      • Opcode Fuzzy Hash: 1f52d9892fc033aacd12757219a004e32a9f7d8e2f55fffd1daee766a8be0e4a
                      • Instruction Fuzzy Hash: E2311476720A518AE720DFB6E4487DD33B1F388B89F450125EF0A97BA8CF79D4068780
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: DllGetVersion
                      • API String ID: 310444273-2861820592
                      • Opcode ID: 0ebd61c28081fcb884182ff04e9529567bc3d32a7f56ff65f6f08314e1981eb9
                      • Instruction ID: 6cad01e5c74d91966e8b677f397e00e8319b1b426cda1d04192f9f397e4fbf14
                      • Opcode Fuzzy Hash: 0ebd61c28081fcb884182ff04e9529567bc3d32a7f56ff65f6f08314e1981eb9
                      • Instruction Fuzzy Hash: 8A213B32211B4086EB52DF26E89079A73A0FB8CB98F584225EB4D477B9DF38C995C750
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • VirtualAlloc.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002C49
                      • VirtualAlloc.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002C63
                        • Part of subcall function 0000000140002B4C: FreeLibrary.KERNEL32(?,?,?,0000000140002D3F,?,?,?,00000001400012C0), ref: 0000000140002BA6
                        • Part of subcall function 0000000140002B4C: free.LIBCMT ref: 0000000140002BBB
                        • Part of subcall function 0000000140002B4C: VirtualFree.KERNEL32(?,?,?,0000000140002D3F,?,?,?,00000001400012C0), ref: 0000000140002BD1
                        • Part of subcall function 0000000140002B4C: GetProcessHeap.KERNEL32(?,?,?,0000000140002D3F,?,?,?,00000001400012C0), ref: 0000000140002BD7
                        • Part of subcall function 0000000140002B4C: HeapFree.KERNEL32(?,?,?,0000000140002D3F,?,?,?,00000001400012C0), ref: 0000000140002BE5
                      • GetProcessHeap.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002C75
                      • HeapAlloc.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002C84
                      • VirtualAlloc.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002CB0
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AllocHeapVirtual$Free$Process$Libraryfree
                      • String ID:
                      • API String ID: 534261519-0
                      • Opcode ID: 572f210408234179bb4c2529e6a5b75765f13b61671de806369ca9f7f2e712cf
                      • Instruction ID: 1dce4e28f6f9c210d6635de50933b2b48fb5f85bea8c104e9e161a8a76fd7a4b
                      • Opcode Fuzzy Hash: 572f210408234179bb4c2529e6a5b75765f13b61671de806369ca9f7f2e712cf
                      • Instruction Fuzzy Hash: 514167B2710B5087EB56DB23E444B9973A5FB88FC4F048425EF0907BA5DF38D9528B40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Resource$FindFreeLoadLock
                      • String ID:
                      • API String ID: 1078018258-0
                      • Opcode ID: 165f5693d75f84c7fa48eb26979c0dbee78286aa5e3c49a8e6288fba64c6bde6
                      • Instruction ID: c4840c82f48973f2062049cc9a8f6c088ec2b1e624f49f12e32064f18c936bc1
                      • Opcode Fuzzy Hash: 165f5693d75f84c7fa48eb26979c0dbee78286aa5e3c49a8e6288fba64c6bde6
                      • Instruction Fuzzy Hash: 8E212C76201A9086EA69DB53E1447AA73B4F74CFD0F189025EF9617764DF38D8A1C350
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 1e1589992e68cefba459b03effaeb64b274bfdb1d9f6b9e6ee26cfff7f953610
                      • Instruction ID: f95b4dfa41e25c5450a222336757182446aeac68f02e92ac0cff84c60cad2bc7
                      • Opcode Fuzzy Hash: 1e1589992e68cefba459b03effaeb64b274bfdb1d9f6b9e6ee26cfff7f953610
                      • Instruction Fuzzy Hash: 2D52F07121669482FEAA8B17A0503FE92E1F7CDBC4F944916BB5A5F7F6DE3AC4018340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 299 14001f9a8-14001f9dc GetSysColor 300 14001f9ee 299->300 301 14001f9de-14001f9e8 GetSysColor 299->301 303 14001f9f0-14001fa03 GetSysColor 300->303 301->300 302 14001f9ea-14001f9ec 301->302 302->303 304 14001fa05-14001fa12 GetSysColor 303->304 305 14001fa18 303->305 304->305 306 14001fa14-14001fa16 304->306 307 14001fa1a-14001fb73 call 140018580 GetDeviceCaps GetSysColor * 21 305->307 306->307 310 14001fb75-14001fb7e 307->310 311 14001fb80-14001fb92 GetSysColor 307->311 312 14001fb99-14001fbb2 GetSysColorBrush 310->312 311->312 313 14001fbb4-14001fbb9 call 1400142f8 312->313 314 14001fbba-14001fbd3 GetSysColorBrush 312->314 313->314 316 14001fbd5-14001fbda call 1400142f8 314->316 317 14001fbdb-14001fbf4 GetSysColorBrush 314->317 316->317 320 14001fbf6-14001fbfb call 1400142f8 317->320 321 14001fbfc-14001fd8c call 140018810 CreateSolidBrush call 140018790 call 140018810 CreateSolidBrush call 140018790 call 140018810 CreateSolidBrush call 140018790 call 140018810 CreateSolidBrush call 140018790 call 140018810 CreateSolidBrush call 140018790 call 140018810 CreateSolidBrush call 140018790 call 140018810 CreateSolidBrush call 140018790 call 140018810 CreatePen call 140018790 call 140018810 CreatePen call 140018790 call 140018810 CreatePen call 140018790 317->321 320->321 365 14001fd8e-14001fd93 321->365 366 14001fd9d-14001fda4 321->366 365->366 367 14001fd95-14001fd98 call 140018810 365->367 368 14001fda6-14001fe0c CreateSolidBrush call 140018790 366->368 369 14001fe0e-14001fe25 call 14001e2f8 366->369 367->366 377 14001fe72-14001fe96 call 140055244 call 1400185e4 368->377 375 14001fe27-14001fe2c call 1400142f8 369->375 376 14001fe2d-14001fe6d call 140018790 CreatePatternBrush call 140018790 call 140009af8 369->376 375->376 376->377
                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Color$BrushCreate$Solid$CapsDevicePattern
                      • String ID:
                      • API String ID: 3066057030-0
                      • Opcode ID: 0f7036fb6bbea27879aad2033d7b4d5a438617b0ad9d88c595b36c9d5e1043bd
                      • Instruction ID: df054a8aeaef4901d89132902dbb425bfd78e68d584666eaf35da574a2ddb19e
                      • Opcode Fuzzy Hash: 0f7036fb6bbea27879aad2033d7b4d5a438617b0ad9d88c595b36c9d5e1043bd
                      • Instruction Fuzzy Hash: F5E14F32614A409BE71AEF32D9987ED73A0FB4CB50F44412AE71A876B5EF35D568CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Rect$Monitor$ClientCopyFromInfoParent$LongMessagePointsSend
                      • String ID:
                      • API String ID: 3793286494-0
                      • Opcode ID: 4829db703c72a4b1667981e976d7d1f3d847d7addd55380847b8a69cc083f036
                      • Instruction ID: 037143d1b1de25fccbbce76c61d98701195cd9ff8c6e7541d4f57ef41192b5ed
                      • Opcode Fuzzy Hash: 4829db703c72a4b1667981e976d7d1f3d847d7addd55380847b8a69cc083f036
                      • Instruction Fuzzy Hash: 75714A72710A419AEB16DF7AE958BEC3371F748B88F444525EF0A5BB68DF38DA058700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 661 1800078d0-1800078fa 662 180007904-180007911 661->662 663 1800078fc-1800078ff call 180006e40 661->663 665 180007913-180007918 662->665 666 18000791d-180007928 662->666 663->662 667 1800079f5-180007a10 call 18000ae60 665->667 668 18000792a call 1800065b0 666->668 669 18000792f-18000793f 666->669 668->669 672 180007941-180007947 669->672 673 180007995-180007998 669->673 677 180007949-18000794c 672->677 678 18000798d-180007993 672->678 675 1800079a9-1800079b5 673->675 676 18000799a-1800079a4 call 1800070d0 673->676 680 180007a11-180007a1a 675->680 681 1800079b7-1800079bb 675->681 676->675 677->678 682 18000794e-180007956 677->682 678->672 678->673 684 180007a1c 680->684 685 180007a3d-180007a4b 680->685 686 1800079d9 681->686 687 1800079bd-1800079c1 681->687 682->678 683 180007958-18000798a call 180006140 682->683 683->678 689 180007a20-180007a24 684->689 691 180007a50-180007a5f 685->691 692 1800079db-1800079ed call 180007760 686->692 687->686 690 1800079c3-1800079c6 687->690 694 180007a26-180007a2a 689->694 695 180007a2c 689->695 696 1800079c8-1800079ce 690->696 697 1800079d0-1800079d7 690->697 691->691 698 180007a61-180007a64 691->698 692->667 694->695 701 180007a30-180007a3b 694->701 695->701 696->686 696->697 697->692 702 180007a66-180007a6e 698->702 703 180007a70-180007a82 698->703 701->685 701->689 704 180007ab4-180007ae4 wsprintfW 702->704 705 180007c24-180007c29 call 18000be84 703->705 706 180007a88-180007a9c 703->706 710 180007b05-180007b4a call 180007760 CreateFileW 704->710 707 180007ae6-180007b03 wsprintfW 706->707 708 180007a9e-180007aa2 706->708 707->710 708->707 711 180007aa4-180007aa7 708->711 716 180007b56-180007b6c call 1800068c0 710->716 717 180007b4c 710->717 711->704 714 180007aa9-180007ab2 711->714 714->704 714->707 720 180007b6e-180007b7f call 18000b5f0 716->720 721 180007b80-180007b9f call 180006ae0 716->721 717->716 720->721 726 180007ba1-180007ba3 721->726 727 180007c07 721->727 728 180007ba5 726->728 729 180007bd6-180007bdb 726->729 730 180007c0c-180007c18 CloseHandle call 180006e40 727->730 731 180007ba7-180007bc9 WriteFile 728->731 732 180007bcb-180007bd0 728->732 729->730 737 180007c1d 730->737 731->732 734 180007bdd-180007be2 731->734 735 180007bd2-180007bd4 732->735 736 180007be4-180007c05 SetFileTime 732->736 734->730 735->721 735->729 736->730 737->705
                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: File$wsprintf$CloseCreateHandleTimeWrite
                      • String ID: %s%s$%s%s%s$:
                      • API String ID: 1593831391-3034790606
                      • Opcode ID: 6ca435d08f868a7fb59b5864507620b8abba209bd1707243c1eb47b977580503
                      • Instruction ID: 257bdb6db1bc698dd34f08cf985adc463d67b8981ab06abec51fab1ebc6aecef
                      • Opcode Fuzzy Hash: 6ca435d08f868a7fb59b5864507620b8abba209bd1707243c1eb47b977580503
                      • Instruction Fuzzy Hash: 7AA1BF32B0468882EBA6DF24E0447EE73A0F398BD4F44C116EA9D436D6DF38CA59C741
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MenuMessageSend$Append$Systemfreemalloc
                      • String ID: 7
                      • API String ID: 4160033202-1790921346
                      • Opcode ID: e13a124cc6d6c21ff2076a7d1f7c7f4ed833d54a06439d5120dd0f58e92f47cb
                      • Instruction ID: c2b7d3d1a5c8da7c22a6310bbddbd078a22331eb5d8edcb90667df8a85d2eff0
                      • Opcode Fuzzy Hash: e13a124cc6d6c21ff2076a7d1f7c7f4ed833d54a06439d5120dd0f58e92f47cb
                      • Instruction Fuzzy Hash: 2B619DB270068583EB2AEF26E4507DD7361F788B94F444126AB5E07BA6DF38D615CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 786 140008560-1400085ad call 140015a44 789 1400085e7-1400085ea 786->789 790 1400085af-1400085e2 call 140015a44 FindResourceW LoadResource 786->790 792 1400085ec-1400085f8 LockResource 789->792 793 1400085fd-140008600 789->793 790->789 792->793 795 140008602-140008606 793->795 796 14000860b-140008644 call 140007ef0 call 14000e7a0 793->796 797 1400087e6-1400087f4 795->797 802 1400086d2-1400086f2 call 140011580 call 14000e684 call 1400082e8 796->802 803 14000864a-140008653 GetDesktopWindow 796->803 815 1400086f7-1400086f9 802->815 803->802 804 140008655-140008660 IsWindowEnabled 803->804 804->802 806 140008662-140008682 EnableWindow call 140005134 804->806 812 140008693-14000869e 806->812 813 140008684-140008690 806->813 812->802 816 1400086a0-1400086af 812->816 813->812 818 1400086fb-140008702 815->818 819 14000874d-14000877c 815->819 816->802 828 1400086b1-1400086bb call 1400136e8 816->828 821 140008723-140008728 818->821 822 140008704-14000871e call 140013510 call 14000df9c 818->822 825 14000878b-14000878e 819->825 826 14000877e-140008786 call 140013710 819->826 821->819 824 14000872a-14000874c call 140013868 821->824 822->821 824->819 832 14000879e-1400087a1 825->832 833 140008790-140008798 EnableWindow 825->833 826->825 828->802 840 1400086bd-1400086ca call 140013710 828->840 838 1400087a3-1400087ad GetActiveWindow 832->838 839 1400087b8-1400087d4 call 140007f4c 832->839 833->832 838->839 841 1400087af-1400087b2 SetActiveWindow 838->841 847 1400087d6-1400087d9 FreeResource 839->847 848 1400087df 839->848 840->802 841->839 847->848 848->797
                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Resource$ActiveEnable$DesktopEnabledFindFreeHookLoadLockUnhookWindows
                      • String ID:
                      • API String ID: 3362358738-0
                      • Opcode ID: 1f04c335932b7b39e38d81ef0b043124358677c3fe5e5b7eca59b54f1db274bd
                      • Instruction ID: 78dc7e13a218d1ed90df5ca419bcf824c57a8f2e2315c260065f4e546a88426d
                      • Opcode Fuzzy Hash: 1f04c335932b7b39e38d81ef0b043124358677c3fe5e5b7eca59b54f1db274bd
                      • Instruction Fuzzy Hash: 0F6192B1209A8082EA6AEB23B5547EE63A1FB89FD1F144124EF9907BF5CF38C451C701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
                      • String ID:
                      • API String ID: 2667261700-0
                      • Opcode ID: e186f3c6cf822b7ce866dc59da29ee821b0174ffe3a5d9fade48e8fe13873a7c
                      • Instruction ID: 895e863caa3190588869d53b5269b22312ddbc91d1d2c12d49150f10eb7ae5fd
                      • Opcode Fuzzy Hash: e186f3c6cf822b7ce866dc59da29ee821b0174ffe3a5d9fade48e8fe13873a7c
                      • Instruction Fuzzy Hash: E841927270164083EB199B27E5983E873A1FB8CF81F014525EB6A4BBB5DF39D861C300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$AtomCallGlobalProcPropRect$DeleteFindLongRemove
                      • String ID: AfxOldWndProc423
                      • API String ID: 3892049428-1060338832
                      • Opcode ID: 5ea7d610ac5369d21026764f2c114df6279f9b325e1e7e04fd46d5daa6176d08
                      • Instruction ID: 2f86615cc92b44afcfb2d4deea6798f5c9692d5f81e6059dab827d5bdf975efc
                      • Opcode Fuzzy Hash: 5ea7d610ac5369d21026764f2c114df6279f9b325e1e7e04fd46d5daa6176d08
                      • Instruction Fuzzy Hash: 5E41DE7220468481EA6A9B67B9947EA6390F78EFD4F000215FF9A0BBB6CF3DC0458741
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Create$ErrorFileLastModuleName
                      • String ID: 8
                      • API String ID: 1315026305-4194326291
                      • Opcode ID: e3cf2ff7dc2ad093880fe1047c2e709ecf49a0301061600d0994d2d58b00cdc4
                      • Instruction ID: 267122bbd1efd68ddfdb6baba0726041bceec1df597bb10a791beaf41949b997
                      • Opcode Fuzzy Hash: e3cf2ff7dc2ad093880fe1047c2e709ecf49a0301061600d0994d2d58b00cdc4
                      • Instruction Fuzzy Hash: E6310C32100B8485E7618F61E88438973A4F34CBA8F94432AEBAC5BBE4DF79C549CB50
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Control-flow Graph

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CreateDebugEventOutputString
                      • String ID: TLS callback: process attach$TLS callback: thread attach
                      • API String ID: 2860077079-2667624547
                      • Opcode ID: 91143723f62c5719960f3cbda51544ccb74cdddfd188f9b911d0301cc6200eba
                      • Instruction ID: 13de91be540606a459de39574c6e4a4224f3989bcdd82a6e98ac9e425c767a12
                      • Opcode Fuzzy Hash: 91143723f62c5719960f3cbda51544ccb74cdddfd188f9b911d0301cc6200eba
                      • Instruction Fuzzy Hash: C2113574A02A088AF7D7CBE1B8957D832A1A78C3C5F48C121FD0A422A0DF39429DC710
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CriticalSection$Profile$EnterInitializeLeave
                      • String ID: DragDelay$DragMinDist$windows
                      • API String ID: 2203521320-2101198082
                      • Opcode ID: e09f57b2594d6d87155fad0858b9837fe7f8f07bb651bf55aea1384f56e30652
                      • Instruction ID: a30147725d4f5c4712633966980b7926cfb785217bf7f7cf62e7a26ea07aa225
                      • Opcode Fuzzy Hash: e09f57b2594d6d87155fad0858b9837fe7f8f07bb651bf55aea1384f56e30652
                      • Instruction Fuzzy Hash: 33112572521B059BF7129F26E44879833A0F799B3AF410219CB58466F6EBBDC589CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Global$CreateDestroyDialogFreeIndirectLockParamUnlockWindow
                      • String ID:
                      • API String ID: 1794613203-0
                      • Opcode ID: 36ac5b6d9a8941413435bc60104badd2f5545f2797de695cf1081ff73b8fae9a
                      • Instruction ID: bbd51f1b2c9fb3e4118800c6d872f8cf9958807669711ac25830b0edb4b905c1
                      • Opcode Fuzzy Hash: 36ac5b6d9a8941413435bc60104badd2f5545f2797de695cf1081ff73b8fae9a
                      • Instruction Fuzzy Hash: 1E51A372205B8182EA5AEB67A8503EE63A0FB89FD0F444129FF9A477A5DF34C845C701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • DecodePointer.KERNEL32(?,?,?,0000000140154CB9,?,?,?,?,0000000140024A3C), ref: 0000000140154BCD
                      • DecodePointer.KERNEL32(?,?,?,0000000140154CB9,?,?,?,?,0000000140024A3C), ref: 0000000140154BDD
                        • Part of subcall function 0000000140156F4C: _errno.LIBCMT ref: 0000000140156F55
                        • Part of subcall function 0000000140156F4C: _invalid_parameter_noinfo.LIBCMT ref: 0000000140156F60
                      • EncodePointer.KERNEL32(?,?,?,0000000140154CB9,?,?,?,?,0000000140024A3C), ref: 0000000140154C5B
                        • Part of subcall function 000000014015C688: realloc.LIBCMT ref: 000000014015C6B3
                        • Part of subcall function 000000014015C688: Sleep.KERNEL32(?,?,00000000,0000000140154C4B,?,?,?,0000000140154CB9,?,?,?,?,0000000140024A3C), ref: 000000014015C6CF
                      • EncodePointer.KERNEL32(?,?,?,0000000140154CB9,?,?,?,?,0000000140024A3C), ref: 0000000140154C6B
                      • EncodePointer.KERNEL32(?,?,?,0000000140154CB9,?,?,?,?,0000000140024A3C), ref: 0000000140154C78
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
                      • String ID:
                      • API String ID: 1909145217-0
                      • Opcode ID: a7fef7b8352f96f2f49d7ed5bd03b0c279b3e847f99dc439c1538f6fa9b82a9d
                      • Instruction ID: a63e4b148bcf802eadb84626116b67609d0dd805a4b65fed85d7b2360886a250
                      • Opcode Fuzzy Hash: a7fef7b8352f96f2f49d7ed5bd03b0c279b3e847f99dc439c1538f6fa9b82a9d
                      • Instruction Fuzzy Hash: 25212A31302B5482EB529B63E9583D9A3A5B78CFD8F484825DF4E0B7B5DB79C585C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateDeactivateLibraryLoad
                      • String ID:
                      • API String ID: 390198777-0
                      • Opcode ID: c5e293d310dce74593145fdd518703decf3910f8a18384ca08f17969a4f0642b
                      • Instruction ID: e683ef7653e9ea4f5a87a2d2965428b1415d152203efb5143b7486b6b6956aea
                      • Opcode Fuzzy Hash: c5e293d310dce74593145fdd518703decf3910f8a18384ca08f17969a4f0642b
                      • Instruction Fuzzy Hash: 59014C72204A4482EB629B27F84479AA6A4F78CFC1F194524EF594B778DF3DC4458700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: memcpy_s$memmove_s
                      • String ID:
                      • API String ID: 2881915579-0
                      • Opcode ID: d66fa21fcb89d196d5e04e7f4c5d1b6b1648c2faa10b73c18d9be65a92d589ef
                      • Instruction ID: 13fe4325ec0dc38ce89534ee57184b7721bc25640689c3dc7bd55b1ae3a470b7
                      • Opcode Fuzzy Hash: d66fa21fcb89d196d5e04e7f4c5d1b6b1648c2faa10b73c18d9be65a92d589ef
                      • Instruction Fuzzy Hash: 035102B6701A4585EB0AEF17E5543EDA765FB8CBC0F548129FB1907BA5CB35C8118700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CloseOpenQueryValue
                      • String ID:
                      • API String ID: 3677997916-0
                      • Opcode ID: bc6cff4458073c524b4180194124dd8424f3298114f7fd20bf079c6d36e6a262
                      • Instruction ID: f71c0bf15fb1f2bff4ea6d5df06f35f0f7136590934fe178f518f03e127045cf
                      • Opcode Fuzzy Hash: bc6cff4458073c524b4180194124dd8424f3298114f7fd20bf079c6d36e6a262
                      • Instruction Fuzzy Hash: 8E314FB3610A80DBEB61CF22E884BD933A0F3187ADF541215FB0D47AA8DB78D885C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _itow$xtoa
                      • String ID:
                      • API String ID: 158661582-0
                      • Opcode ID: 2d3a3922f5f7bf6a16deb8c4cf1b51d91c40a4b8389e27c9e8f5e2d084831faf
                      • Instruction ID: b08afd1a056ea51c603aae7d80a7b9ad8b178cd6cbdc143748c19d4b4bf88a9f
                      • Opcode Fuzzy Hash: 2d3a3922f5f7bf6a16deb8c4cf1b51d91c40a4b8389e27c9e8f5e2d084831faf
                      • Instruction Fuzzy Hash: 8411A13035028087E606AB43A8507EE621697CAFD0F184038BF4B0BBEBCD3DD9018740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AllocateHeap_callnewh_errno
                      • String ID:
                      • API String ID: 638267422-0
                      • Opcode ID: 962dab79c17ac8fdfe494987895a3bdba823120161847823926d89dbeb5fb5f9
                      • Instruction ID: bd87de62efebc8666f019b4e36733f6b9f93f433b82a5b8de8421a7ef3ee8fb6
                      • Opcode Fuzzy Hash: 962dab79c17ac8fdfe494987895a3bdba823120161847823926d89dbeb5fb5f9
                      • Instruction Fuzzy Hash: D7114C3130664086FF5B5B27D6447E962D19B9CFE4F0C8A288B254F6F8EBBAC8509741
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      • \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC\COMAutoApprovalList, xrefs: 0000000180002BE7
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: OpenRtlp
                      • String ID: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC\COMAutoApprovalList
                      • API String ID: 2893929204-3411063540
                      • Opcode ID: fa70462b364a80615b0930a94f141768019b09ba859b160873eb653f66363a18
                      • Instruction ID: 4e2fa412fe1fe2dc53f04cfb5f2bb0b0e9ab8309a6190356007f67e43cb60965
                      • Opcode Fuzzy Hash: fa70462b364a80615b0930a94f141768019b09ba859b160873eb653f66363a18
                      • Instruction Fuzzy Hash: BA315273210B949AE762CF21D880BD937A4F748B98F559126FE4E47B58EF34C299C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l
                      • String ID: _ElvFunc
                      • API String ID: 2941638530-892560642
                      • Opcode ID: 63292f68687b78b892faa5132dc7df1c91f24965a4bf1d27da3cff898d41be5d
                      • Instruction ID: f16652dd2ad1ccccb50743743bf8797549a40be6db1820eeedfdcb6abf0a19a5
                      • Opcode Fuzzy Hash: 63292f68687b78b892faa5132dc7df1c91f24965a4bf1d27da3cff898d41be5d
                      • Instruction Fuzzy Hash: 59017C71601A0582EA05AB2AE8513993760FBC5BB4F904315E77D477F1DF38C851C744
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CompatibleCreate
                      • String ID:
                      • API String ID: 3111197059-0
                      • Opcode ID: d768af12ff248e0dc69eb8f7ae5a68ae799214d7741860193fc106a586396ce7
                      • Instruction ID: 491e10b16f643cb53afe7b0906ba9bd223f1a44cb6e357fdd09642c73fc5146a
                      • Opcode Fuzzy Hash: d768af12ff248e0dc69eb8f7ae5a68ae799214d7741860193fc106a586396ce7
                      • Instruction Fuzzy Hash: 1761C772501B8085E7418F35E9403D8B7FCFB68B98F18423ADB984BBA9DF7485A4C790
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • VirtualFree.KERNEL32(?,?,00000000,0000000140002D0A,?,?,?,00000001400012C0), ref: 0000000140002822
                      • VirtualProtect.KERNEL32(?,?,00000000,0000000140002D0A,?,?,?,00000001400012C0), ref: 000000014000287F
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Virtual$FreeProtect
                      • String ID:
                      • API String ID: 2581862158-0
                      • Opcode ID: ba379bad051316654865e9e4f062ac2559f8c53fb75408cf511cbb70a9974521
                      • Instruction ID: 6fa6472316e2e36f3fdfda8698bd75f220f27b5464f7fd7630ac82b1b076d477
                      • Opcode Fuzzy Hash: ba379bad051316654865e9e4f062ac2559f8c53fb75408cf511cbb70a9974521
                      • Instruction Fuzzy Hash: 263189B6705A4087E756CF2AE944BAD37A1F788FC8F588102EF4A573A8DB38C945C701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MetricsObjectSelectText$Window
                      • String ID:
                      • API String ID: 1921638516-0
                      • Opcode ID: ddc070019667d21379c3b817bdd11dc7e27ea87d0b22340df5dfd395e228ff35
                      • Instruction ID: 2b999344856c4920b47872e0c1a9f444ca52aabea943806e20093fb7cacb8386
                      • Opcode Fuzzy Hash: ddc070019667d21379c3b817bdd11dc7e27ea87d0b22340df5dfd395e228ff35
                      • Instruction Fuzzy Hash: CF310432701A84ABEB19DF66D8943DD7361F748798F840126AF2A8B7A9DF34CA15C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Rect
                      • String ID:
                      • API String ID: 3200805268-0
                      • Opcode ID: 219e5de8ba322cade749662eb6f286d127ba8eab8d5a7ab829fb69757d066e4e
                      • Instruction ID: fc8538277c9b0b3a4ac940275272186486788c04e14fa9dc4ce47b408ac318ef
                      • Opcode Fuzzy Hash: 219e5de8ba322cade749662eb6f286d127ba8eab8d5a7ab829fb69757d066e4e
                      • Instruction Fuzzy Hash: 52113D7221464086EB25DB23F5543AA73A1FB8CFD9F448525EB4D47BA5EF38C8109B01
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: FolderFromListLocationPathSpecial
                      • String ID:
                      • API String ID: 4082711253-0
                      • Opcode ID: 71f2c1e93379fa6d12e89ff48aadce70b3cdc56e47d51651213bfe1d93b94b13
                      • Instruction ID: a56562d9700250eb7056d02fef5906dc8bc8b0d2183487c3eabc0b89e9b51620
                      • Opcode Fuzzy Hash: 71f2c1e93379fa6d12e89ff48aadce70b3cdc56e47d51651213bfe1d93b94b13
                      • Instruction Fuzzy Hash: DF118232218A8892DB51CF61E59439A7360FB887D4F44A215FBAD07AD9DF3CC258C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: FolderFromListLocationPathSpecial
                      • String ID:
                      • API String ID: 4082711253-0
                      • Opcode ID: 88b1f26f9d83468ba4dae8422dd686669e8fab3da6e459c0422bb2df6fa84342
                      • Instruction ID: 11286cfbcb307368df4eadc45b36d67c3a2819914de47289d0f50b8fea47da88
                      • Opcode Fuzzy Hash: 88b1f26f9d83468ba4dae8422dd686669e8fab3da6e459c0422bb2df6fa84342
                      • Instruction Fuzzy Hash: 66118232214A8896DB51CF51E49479A7360FB887E4F44A215FBAD07AD9DF3CC258C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ProcWindow$Call
                      • String ID:
                      • API String ID: 2316559721-0
                      • Opcode ID: 82bb7afbfa862befb514044eac10ef5ca91323d325537cf4d7613500760e6114
                      • Instruction ID: 5e5ac174aad4b3c07b63683a9cc69db069b720c3353d7e47513647600642f034
                      • Opcode Fuzzy Hash: 82bb7afbfa862befb514044eac10ef5ca91323d325537cf4d7613500760e6114
                      • Instruction Fuzzy Hash: 7D011636714B8485EA15CB47E4907A8B764F799FC4F688025EF4A03B68CF39C552C780
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Sleepmallocrealloc
                      • String ID:
                      • API String ID: 276608700-0
                      • Opcode ID: cdcf78e2606893c8032822aa8caebadf5d645ecd3dfd9430aca0b3cbb392e8fa
                      • Instruction ID: 04f77590d91c4e459ec81c49df3fabbeee001657528994032bebeacb8b4bc640
                      • Opcode Fuzzy Hash: cdcf78e2606893c8032822aa8caebadf5d645ecd3dfd9430aca0b3cbb392e8fa
                      • Instruction Fuzzy Hash: 8901AD36620B808AEA569F17951039AB2A1F78CFE0F4D5126EF590BBA0DB39DD40CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Error$FileModeModuleName$ExtensionFindLastPath
                      • String ID:
                      • API String ID: 3856306541-0
                      • Opcode ID: 586bfcbd3ed663a69bc291389e4e2c21115ad91c15d98e44d820c37339971198
                      • Instruction ID: ff9fca96275644465fe71e87a74ee1ccd2db552894b3d690818a9117f3eeab2b
                      • Opcode Fuzzy Hash: 586bfcbd3ed663a69bc291389e4e2c21115ad91c15d98e44d820c37339971198
                      • Instruction Fuzzy Hash: 7D014F3260578081FB46AB62B4853DD66A4FB8CB80F5C8538B7894B7B6CF35C4818301
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CurrentHookThreadWindows
                      • String ID:
                      • API String ID: 1904029216-0
                      • Opcode ID: 8ad1b6cc13bfa35ad82d2a50b5156949f3c59cb7f5140c028a33bc17d91ff678
                      • Instruction ID: 5001d2bbf9be1eb68d84e59635873c6dcd8a35630b790d527b4766ed6b90fb58
                      • Opcode Fuzzy Hash: 8ad1b6cc13bfa35ad82d2a50b5156949f3c59cb7f5140c028a33bc17d91ff678
                      • Instruction Fuzzy Hash: 00018171601E0481EB1A9B67E4947D863A0EF8CBC8F501015F7190BABAEE39C588C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CurrentHookThreadWindows
                      • String ID:
                      • API String ID: 1904029216-0
                      • Opcode ID: 2919cd8e7d5101f14b689c0ade9adde16939adf0ca0db5fc12d3fa5b925b0965
                      • Instruction ID: 9143d19de11b0bb0dd3bb12284c0394bc6060e51dd9315acca699b11774fa0f7
                      • Opcode Fuzzy Hash: 2919cd8e7d5101f14b689c0ade9adde16939adf0ca0db5fc12d3fa5b925b0965
                      • Instruction Fuzzy Hash: 0CE08CB0A0064481FB2677BAA885B983691EB0EBA6F841204EB240F2F1DF38C0C88701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • VirtualAlloc.KERNEL32(?,?,?,0000000140002CE5,?,?,?,00000001400012C0), ref: 0000000140002731
                      • VirtualAlloc.KERNEL32(?,?,?,0000000140002CE5,?,?,?,00000001400012C0), ref: 000000014000275D
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AllocVirtual
                      • String ID:
                      • API String ID: 4275171209-0
                      • Opcode ID: 2fb1c72e46752a2507161d0c89529716d08367b30d8000a3af35914e3d8f2fc4
                      • Instruction ID: 28aee1d7fdb587f29ff38dd01f49958648d66125669cc7b1273ab539cddc5934
                      • Opcode Fuzzy Hash: 2fb1c72e46752a2507161d0c89529716d08367b30d8000a3af35914e3d8f2fc4
                      • Instruction Fuzzy Hash: 1E2179B671465086D719CB03FA84B9EB7A1F74CBD1F458415EF4907765DB38C4A2CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • malloc.LIBCMT ref: 000000014015C5AF
                        • Part of subcall function 00000001401556AC: _FF_MSGBANNER.LIBCMT ref: 00000001401556DC
                        • Part of subcall function 00000001401556AC: RtlAllocateHeap.NTDLL(?,?,00000018,0000000140002DA0), ref: 0000000140155701
                        • Part of subcall function 00000001401556AC: _callnewh.LIBCMT ref: 000000014015571A
                        • Part of subcall function 00000001401556AC: _errno.LIBCMT ref: 0000000140155725
                        • Part of subcall function 00000001401556AC: _errno.LIBCMT ref: 0000000140155730
                      • Sleep.KERNEL32(?,?,?,000000014015E459,?,?,00000000,000000014015E503,?,?,00000000,000000014015A9F9,?,?,00000000,000000014015AAB0), ref: 000000014015C5C2
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _errno$AllocateHeapSleep_callnewhmalloc
                      • String ID:
                      • API String ID: 3606348469-0
                      • Opcode ID: b588d367f3396e4a184c0b692e7853239f580eef77a6661b79b7746df66e5aa2
                      • Instruction ID: 88714615757311d59d494f25ed5b26ab3214a83b5a84948068f9b0641aaf8ca4
                      • Opcode Fuzzy Hash: b588d367f3396e4a184c0b692e7853239f580eef77a6661b79b7746df66e5aa2
                      • Instruction Fuzzy Hash: 33018C32220B848AEA129F47A45039977A0F78CFA0F5D4115EF490B7A5EF79E881CB84
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Resource$FindLoad
                      • String ID:
                      • API String ID: 2619053042-0
                      • Opcode ID: 61299a80cb2baa5ddb31358264eff51f8ed9ecd9d646ef94b97f919ce8975d02
                      • Instruction ID: 90c861f7fcc8838ca9de4b027f00c9476570e7af4a447d3e18d8cc38312f474c
                      • Opcode Fuzzy Hash: 61299a80cb2baa5ddb31358264eff51f8ed9ecd9d646ef94b97f919ce8975d02
                      • Instruction Fuzzy Hash: 45217876701A9086EB0ADF16A4A53ED67A1B78CBC0F548029EB9D47BA5DF39D811C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: memcpy_s
                      • String ID:
                      • API String ID: 1502251526-0
                      • Opcode ID: f415cfbd1c01ff5a07367c1721c8ea63a104035b1095ed3f20613595809a11ee
                      • Instruction ID: 34762f509ac4f81b72cd5985a5b1682b1779c7e1745058e527489d8fde0d16a2
                      • Opcode Fuzzy Hash: f415cfbd1c01ff5a07367c1721c8ea63a104035b1095ed3f20613595809a11ee
                      • Instruction Fuzzy Hash: EE112676B01B4482EB149F6AE44529CB7A5FBC8FD4F188016EB5947B65DE74C881C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ItemNext
                      • String ID:
                      • API String ID: 4145397660-0
                      • Opcode ID: 38159672ed185ef9e546b28fba6b8d3c0f36fe20ffc94dd467412b6efe24ba75
                      • Instruction ID: d3a61d9f9af76e6e125dcb2baa919b098eaa27272f1efb779ae66e8f13595423
                      • Opcode Fuzzy Hash: 38159672ed185ef9e546b28fba6b8d3c0f36fe20ffc94dd467412b6efe24ba75
                      • Instruction Fuzzy Hash: 3F117CB1201B8581FEA6DB77A5547E92390BB8CFC4F084535AF991B3A6DE3AC4448310
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 3b08e17445c2c762feca2e988ba69b9362fa09f6858b55592959441959c511c2
                      • Instruction ID: e480ba6142520e62b6baf6ad5564c518d341ae1a25d4bb9d233d31736a2e3bf3
                      • Opcode Fuzzy Hash: 3b08e17445c2c762feca2e988ba69b9362fa09f6858b55592959441959c511c2
                      • Instruction Fuzzy Hash: 08F08C7220875082EA21DB43B4007A9A6A4E7E8FC0F6C8125FF8803B69DF38C551A642
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                        • Part of subcall function 0000000140001548: LoadIconW.USER32 ref: 00000001400015A8
                        • Part of subcall function 0000000140008560: FindResourceW.KERNEL32 ref: 00000001400085CD
                        • Part of subcall function 0000000140008560: LoadResource.KERNEL32 ref: 00000001400085D9
                        • Part of subcall function 0000000140008560: LockResource.KERNEL32 ref: 00000001400085EF
                      • Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCMT ref: 0000000140001143
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Resource$ContextExternalLoad$BaseBase::~Concurrency::details::FindIconLock
                      • String ID:
                      • API String ID: 639982490-0
                      • Opcode ID: f4d9c8e4df27fb387ad3a648c2567c1733832477e48916a08b0c733b7b07cf01
                      • Instruction ID: 4e4f6820898635d676e396915d2ea7e8c434fbc47d7238b97318b89ca3b0422f
                      • Opcode Fuzzy Hash: f4d9c8e4df27fb387ad3a648c2567c1733832477e48916a08b0c733b7b07cf01
                      • Instruction Fuzzy Hash: BFF0687233598492E671E761F8523DE7390FBD8764F841221B7AE476F6DE38C5448700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                        • Part of subcall function 0000000140002BFC: VirtualAlloc.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002C49
                        • Part of subcall function 0000000140002BFC: VirtualAlloc.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002C63
                        • Part of subcall function 0000000140002BFC: GetProcessHeap.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002C75
                        • Part of subcall function 0000000140002BFC: HeapAlloc.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002C84
                        • Part of subcall function 0000000140002BFC: VirtualAlloc.KERNEL32(?,?,?,00000001400012C0), ref: 0000000140002CB0
                      • ExitProcess.KERNEL32 ref: 00000001400012FD
                        • Part of subcall function 0000000140002B4C: FreeLibrary.KERNEL32(?,?,?,0000000140002D3F,?,?,?,00000001400012C0), ref: 0000000140002BA6
                        • Part of subcall function 0000000140002B4C: free.LIBCMT ref: 0000000140002BBB
                        • Part of subcall function 0000000140002B4C: VirtualFree.KERNEL32(?,?,?,0000000140002D3F,?,?,?,00000001400012C0), ref: 0000000140002BD1
                        • Part of subcall function 0000000140002B4C: GetProcessHeap.KERNEL32(?,?,?,0000000140002D3F,?,?,?,00000001400012C0), ref: 0000000140002BD7
                        • Part of subcall function 0000000140002B4C: HeapFree.KERNEL32(?,?,?,0000000140002D3F,?,?,?,00000001400012C0), ref: 0000000140002BE5
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AllocHeapVirtual$FreeProcess$ExitLibraryfree
                      • String ID:
                      • API String ID: 1153028573-0
                      • Opcode ID: 70a7a408e2a11379826d9f32a765ff97af7f8402d9a6bba8e431807fad499f05
                      • Instruction ID: 7b623e6c7b120b2c61e825385401d66c8440be1e66ee7d3a350a8af64ea6f2dc
                      • Opcode Fuzzy Hash: 70a7a408e2a11379826d9f32a765ff97af7f8402d9a6bba8e431807fad499f05
                      • Instruction Fuzzy Hash: 94F03AB030164181EE5AEBA7B9957E962916B8CBC0F084036AB0A477F7DE38C5548704
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window
                      • String ID:
                      • API String ID: 2353593579-0
                      • Opcode ID: 01a291ab2ea7d53f40cf977e09ef0ec3fdbc733b6db34e73a0cd6d8dbd75e17f
                      • Instruction ID: fdeed4fc43f196f39eae89709554109410baa7688e5e4f1571141ac92c2f52e1
                      • Opcode Fuzzy Hash: 01a291ab2ea7d53f40cf977e09ef0ec3fdbc733b6db34e73a0cd6d8dbd75e17f
                      • Instruction Fuzzy Hash: 0F01AC76A18740CBD7A0CF2AD48474AB7E1F388784F144125FB8987B28DB39C4458F04
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: IconLoad
                      • String ID:
                      • API String ID: 2457776203-0
                      • Opcode ID: 83136bcfeaef5d216818273d9d019069ab6239c1860ebc2d782afbad3227492b
                      • Instruction ID: 657e6a72722ef2435f88025b8f0bef9ea57193568045831c0b29cb0100465cee
                      • Opcode Fuzzy Hash: 83136bcfeaef5d216818273d9d019069ab6239c1860ebc2d782afbad3227492b
                      • Instruction Fuzzy Hash: AFF01231201B8092D616AB65F9513C97364F788BE0F508325B7AC477F6DF35D5A5C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend
                      • String ID:
                      • API String ID: 3850602802-0
                      • Opcode ID: 8753b231086d8d235b96047afdee54f0cc2c1edbec35c9e226a272bf2762fd22
                      • Instruction ID: 2151763ebe50b35573a3987127163f58bfd5f13bc1516468e66215b49fba3f20
                      • Opcode Fuzzy Hash: 8753b231086d8d235b96047afdee54f0cc2c1edbec35c9e226a272bf2762fd22
                      • Instruction Fuzzy Hash: 92F0F9B25186808BC370CF19E44075A76A0F389798F500319F69C83B94D73DC5118F04
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessagePost
                      • String ID:
                      • API String ID: 410705778-0
                      • Opcode ID: d766e95e5fe2beb429078f504e7c5626d90b0db7f1032a0b3288b7d09be82532
                      • Instruction ID: 17a0614b9d4b60dbfef95cb8eece3e954983d69af7b00e3d43ea41b0b4dd8b78
                      • Opcode Fuzzy Hash: d766e95e5fe2beb429078f504e7c5626d90b0db7f1032a0b3288b7d09be82532
                      • Instruction Fuzzy Hash: D9D05B76B12680CAE754CB3DD855B893650F7CEB4CFD41130D6444B6B0C73680138B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ExitFileModuleNameProcess
                      • String ID:
                      • API String ID: 778004563-0
                      • Opcode ID: 924823d54448024731e9f9dbbf7356945b99d0e92e40eeefae6c1f9123e817ac
                      • Instruction ID: ae226c1083b3e84086870181e3ba839f431c0b968d906d40ad9d3a27836675bc
                      • Opcode Fuzzy Hash: 924823d54448024731e9f9dbbf7356945b99d0e92e40eeefae6c1f9123e817ac
                      • Instruction Fuzzy Hash: 6EA0243050140C51F3CD7370045F3CC103017CC35CF00440D7703400414C1C417C4301
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687465392.0000000180001000.00000040.00000001.sdmp, Offset: 0000000180000000, based on PE: true
                      • Associated: 00000000.00000002.687461542.0000000180000000.00000004.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687487410.0000000180027000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687575907.00000001800DC000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687581595.00000001800E1000.00000040.00000001.sdmp Download File
                      • Associated: 00000000.00000002.687591899.00000001800EF000.00000004.00000001.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_180000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Initialize
                      • String ID:
                      • API String ID: 2538663250-0
                      • Opcode ID: 7f0fa137eb737640148bd4e7b39b91041de766b2f62fa0ec8a61a29e3564a50e
                      • Instruction ID: 2f1fb19c361a65c23886f21907b6cd3f55be32eee7cfb6cb37f38e2b8846fa87
                      • Opcode Fuzzy Hash: 7f0fa137eb737640148bd4e7b39b91041de766b2f62fa0ec8a61a29e3564a50e
                      • Instruction Fuzzy Hash: 37613632211A4999EB51DF65C8943DC33A0FB49BE9F458222EA6E477E4DF39C249D310
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • Sleep.KERNEL32(?,?,?,000000014015AA8B,?,?,00000018,0000000140156059,?,?,?,?,000000014015574A,?,?,00000018), ref: 000000014015C649
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Sleep_errno
                      • String ID:
                      • API String ID: 1068366078-0
                      • Opcode ID: 669d3f650be51ffe023db7de81c585ccbbad970ecfcc73eaf576246cc5daa0b7
                      • Instruction ID: fe1ee07c52b05f70c4f01a697b5973d10eeda96c3b2c3cae9f3998f59bd58797
                      • Opcode Fuzzy Hash: 669d3f650be51ffe023db7de81c585ccbbad970ecfcc73eaf576246cc5daa0b7
                      • Instruction Fuzzy Hash: 3201A232620B8085EA468F17A454799B6A1F38CFE0F491125EF5907BA0CB35D991C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: malloc
                      • String ID:
                      • API String ID: 2803490479-0
                      • Opcode ID: 54febd72cfbfdd59f7820d605860781bbd4765f4c9fe6d6af7225d46d2136357
                      • Instruction ID: 407ca4d082a9032a679708d4b2621c5d557bfbcad3a45ec76ac7e25ddb5ae00c
                      • Opcode Fuzzy Hash: 54febd72cfbfdd59f7820d605860781bbd4765f4c9fe6d6af7225d46d2136357
                      • Instruction Fuzzy Hash: 5CE02B7271028082EB05CF17E59036DB6E0FF9C790F9DC424E7054B791DB7AC8808B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _errno$AllocateHeap_callnewhmalloc
                      • String ID:
                      • API String ID: 2243056865-0
                      • Opcode ID: b35183051354567e631540f208890e39a1d43a925a4915fc06ea803bc2a49be6
                      • Instruction ID: f78953cbb1a70c77ded885a141c5b27a0ea8e6347eb06b1e281d86bd76d9225d
                      • Opcode Fuzzy Hash: b35183051354567e631540f208890e39a1d43a925a4915fc06ea803bc2a49be6
                      • Instruction Fuzzy Hash: A6E0467032A64580FE97DB17B290BBC52909F8CBC0F4C0026BF0D4B7A5EE38C8918300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Non-executed Functions

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: FileModuleName
                      • String ID:
                      • API String ID: 514040917-3916222277
                      • Opcode ID: b346069d058eb964a5b54db20d5fd3e9d7c8654d99c1cd66873ddad020267633
                      • Instruction ID: d0644e094aede9f633651fef856ab369cf27c418d6b21ef8fe0940e8cbb314a3
                      • Opcode Fuzzy Hash: b346069d058eb964a5b54db20d5fd3e9d7c8654d99c1cd66873ddad020267633
                      • Instruction Fuzzy Hash: 2AF14C32314A8086EB229F66E8947DE73B1F788BD8F540125EB5A5BBB9DF38C545C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Parent$Rect$Redraw$Update$Cursor$CaptureInflateInvalidate$AsyncClientCopyScreenState
                      • String ID:
                      • API String ID: 1086551493-0
                      • Opcode ID: 03817acff036ebf5a0447f1281f62f9558b332fc647314066ceb6ac258c6345d
                      • Instruction ID: 1a3a1ff8a12b82526ca9240c1add46048fc121100268c0ee1121628eaa9d6b23
                      • Opcode Fuzzy Hash: 03817acff036ebf5a0447f1281f62f9558b332fc647314066ceb6ac258c6345d
                      • Instruction Fuzzy Hash: E1222376300A8092EB1ADF27DA947ED23A5F788BD8F018025EB0A577B0DF79D8658744
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CreateObject$Select$BitmapCompatible$Color$BrushFillPatternPixelRect
                      • String ID:
                      • API String ID: 1390051538-3916222277
                      • Opcode ID: 5f6a69f796381dd8c78958af101ab4b8875594870b41dbea76965a05b32b06e9
                      • Instruction ID: 07aea426854482ea078885f17444b3d7934c2db9627fef81821a18a26879973f
                      • Opcode Fuzzy Hash: 5f6a69f796381dd8c78958af101ab4b8875594870b41dbea76965a05b32b06e9
                      • Instruction Fuzzy Hash: DBD11632614B508AEB11DB66E8847DE77B4F788B94F500126EF4997BA9DF38C545CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$MessageWindow$Send$ClientPoints$CursorScreen$BeepCaretHide
                      • String ID:
                      • API String ID: 1836756369-0
                      • Opcode ID: 603fdb9e8b11f363dd09d1f9fa3aaadeeb5a8b538078f80d3283cde0708b6ae8
                      • Instruction ID: 4f4ce99ce4397889b0f8487635fc6cd3cb056e3405e3c9b9bfaccd0488fb9f02
                      • Opcode Fuzzy Hash: 603fdb9e8b11f363dd09d1f9fa3aaadeeb5a8b538078f80d3283cde0708b6ae8
                      • Instruction Fuzzy Hash: 5C422876701A4086EB66AF76C8947ED23A1F788FD8F548126EB1A877B5CF39C855C300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object$Select$CompatibleCreate$Delete$BitmapImageLoad
                      • String ID:
                      • API String ID: 3777495891-3916222277
                      • Opcode ID: d971b8f43f82a640c4750da7bfbf08c2af7e25e8386179e4b2a297f3ebbbcbb0
                      • Instruction ID: 18283e4d2a0c4d04f0d8ce7f23afcf4fdeeaba26b4e3dcef3f8d4153485ce781
                      • Opcode Fuzzy Hash: d971b8f43f82a640c4750da7bfbf08c2af7e25e8386179e4b2a297f3ebbbcbb0
                      • Instruction Fuzzy Hash: 61D18C36204A8086EB569F62E8547EE73B1F788BD8F144125EF4A4BBB5DF38D499C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Create$Select$CombineObject$ClipCopyIndirectInflateIntersect$BitmapBrushDeletePattern
                      • String ID: I
                      • API String ID: 1332805902-3707901625
                      • Opcode ID: 9d40f8ad81eab59ef1a2f9b57ef69a365f2d678882313d300574e05fb59bbe9d
                      • Instruction ID: af9218e76fddc17c5ecbd2e1bc9952f2c71f17b83e63016caf70d464b2b9e365
                      • Opcode Fuzzy Hash: 9d40f8ad81eab59ef1a2f9b57ef69a365f2d678882313d300574e05fb59bbe9d
                      • Instruction Fuzzy Hash: 6DA1FA36B04A548AEB11DBB6E894BDE3371B749BD8F404129EF1D67AA8DF34C50AC740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object$CreateSelect$Color$BitmapCompatible$BrushPixelSolid
                      • String ID:
                      • API String ID: 3358463585-3916222277
                      • Opcode ID: 3f0a225bcd2cce91c38cf47d82e3c1326d402f3146e489debe88787c5a9f5846
                      • Instruction ID: 3fe5c8f086f1860e07f390befd51ff5b26c0edacfc84c371c180d4c240e80e93
                      • Opcode Fuzzy Hash: 3f0a225bcd2cce91c38cf47d82e3c1326d402f3146e489debe88787c5a9f5846
                      • Instruction Fuzzy Hash: D6C10632715A408AEB21DF66E8907DD33B1F788B98F500125EF4A6BBA9DF38C955C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: BeepMessageState
                      • String ID:
                      • API String ID: 1934685646-0
                      • Opcode ID: 2f3481ce4c0457b5a9ec85409a092679745b2c8961a6b8844b091a37e6a25d2e
                      • Instruction ID: ca87bbaf18077a0b6da564017a970690d429bc3b5db561b2afe09d4dab6a7cf8
                      • Opcode Fuzzy Hash: 2f3481ce4c0457b5a9ec85409a092679745b2c8961a6b8844b091a37e6a25d2e
                      • Instruction Fuzzy Hash: 27F1387AB00A45DAEB21CFA6D4407ED3361F389B9DF504516EF1A63AA8CB3CCA45C741
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Message$Send$Beep
                      • String ID:
                      • API String ID: 877464050-0
                      • Opcode ID: 15fa241d3e518debc259456c3fbb0f105feaf9d3f9da5b49f8f5fd204d02cd82
                      • Instruction ID: 031c61a0a7ad59447539516d7ce692c22b88fb9c1799496e97db95dad6a25a8c
                      • Opcode Fuzzy Hash: 15fa241d3e518debc259456c3fbb0f105feaf9d3f9da5b49f8f5fd204d02cd82
                      • Instruction Fuzzy Hash: 9702EA7A710A5586EB16DF66D840BED3362F789BD8F404102EF1A67AA5CF3CC851C741
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID:
                      • String ID: $VUUU$VUUU$VUUU
                      • API String ID: 0-2221618125
                      • Opcode ID: d1dc95a13742be9f1670d80e3d279eef535a809866c66b32f72144c074850e9d
                      • Instruction ID: 7ec858af1e1fbed5d6363de3dd7a034d046b633887641f41ad0466dd23da0b78
                      • Opcode Fuzzy Hash: d1dc95a13742be9f1670d80e3d279eef535a809866c66b32f72144c074850e9d
                      • Instruction Fuzzy Hash: E0E1E5327046908AE716EF76D4507ED33A1FB48B98F10412AEF4A9BBE5DB38D806C750
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Empty$Window$CursorOffsetmalloc
                      • String ID:
                      • API String ID: 1075161071-3916222277
                      • Opcode ID: cd69ae7bc9ba47aaecf5c644f8a3bd4eab205a6157be4639655028c609b66849
                      • Instruction ID: 57d741c25ac43249d7173a444e7b830fd9169c1ce9cd883af0bf8e309d4dab53
                      • Opcode Fuzzy Hash: cd69ae7bc9ba47aaecf5c644f8a3bd4eab205a6157be4639655028c609b66849
                      • Instruction Fuzzy Hash: 67F135B2700A408AEB56DF67D9947ED33A4F748B88F044126DF4A97AA4EF38D455C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l$MessageSendinet_ntoa$htonsrecv
                      • String ID: %-15s$ %-4d$ %-5d$%-5d
                      • API String ID: 1261567995-2643228025
                      • Opcode ID: 2490adc055d128ce1133ad1014c58f75f89045d40cf1a63362e8f23056c60c55
                      • Instruction ID: f436b07506dc80d941037bec47272386ee364610de24237355ede40b81b5b08d
                      • Opcode Fuzzy Hash: 2490adc055d128ce1133ad1014c58f75f89045d40cf1a63362e8f23056c60c55
                      • Instruction Fuzzy Hash: 1851A1B2210A9682EB26DF22E4507DE7761F788BE8F854212FB5E076B6DF34D545C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Message$Capture$RectWindow$Dispatch$CursorInflateInvalidatePeekReleaseSendUpdate
                      • String ID:
                      • API String ID: 4077352625-0
                      • Opcode ID: b89444b77d056b03a076f5600f53369f3be69f1b1dc13914e1e1d0633f6ee5c6
                      • Instruction ID: fc22083c879e2d487ab1c66f4ef0c7e6a13ee360536eb6640979c00043504cf3
                      • Opcode Fuzzy Hash: b89444b77d056b03a076f5600f53369f3be69f1b1dc13914e1e1d0633f6ee5c6
                      • Instruction Fuzzy Hash: 54A15C3570264586FB66DB67E854BE923A1BB8DBC4F084021AF0A57BA5EF3AC546C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ChildFocusMessageSendWindow
                      • String ID:
                      • API String ID: 1631116926-0
                      • Opcode ID: 029c150686b520dd39bfb05f531aed452f1ea942e259497be7a39df1c28b8b0e
                      • Instruction ID: 808033e187e0dd8b419153e94e0544d0835ee112324060b340c75049e0bf261e
                      • Opcode Fuzzy Hash: 029c150686b520dd39bfb05f531aed452f1ea942e259497be7a39df1c28b8b0e
                      • Instruction Fuzzy Hash: 649137313016518AFF669F23D8547E923A4BB8CFD4F188026AF5A9B7B1EF79C9418350
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Message$CaptureCursorSend$LoadPeekPostRelease$Wait
                      • String ID:
                      • API String ID: 2899155438-0
                      • Opcode ID: 6792ff458fbe6382b2e6af5ddc3e3f0c0cb4e8d9b880b7e334b282dc47d374f6
                      • Instruction ID: eaf7d7f845e7a47df67f59e7c0042392513fe870e4eca2432aae137a784c7b21
                      • Opcode Fuzzy Hash: 6792ff458fbe6382b2e6af5ddc3e3f0c0cb4e8d9b880b7e334b282dc47d374f6
                      • Instruction Fuzzy Hash: 4C517D36310681C2E766DF63E805BEE26A1FBD8F89F554029EF4947AA8DF39C805C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MetricsSystem$Iconic$Rect$OffsetWindow
                      • String ID:
                      • API String ID: 3418670059-0
                      • Opcode ID: 09c9aa93c110be2ac22ec24663347018b717fb7be780dc10ec238a59554bb2a7
                      • Instruction ID: 16f5b900ca6f3f38491fb82b3323588dad8f09a6bdb985995424992b9d83d71e
                      • Opcode Fuzzy Hash: 09c9aa93c110be2ac22ec24663347018b717fb7be780dc10ec238a59554bb2a7
                      • Instruction Fuzzy Hash: 79411676A10A448AEB058F76D8543ED77B0F348B99F048429DF0A97764EF38C955C790
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Global$CopyFileUnlock$AllocDataDuplicateFreeLockMetaTasklstrlenmemcpy_s
                      • String ID:
                      • API String ID: 3597158810-0
                      • Opcode ID: b339d355f547c120a0ac3eb52d8668421f568afa14e92bebe0838c2e922e8aec
                      • Instruction ID: 12152cb6087ac377b12f1ae3fc52b05160e76055723cedaaa3edcf2e99bfe52f
                      • Opcode Fuzzy Hash: b339d355f547c120a0ac3eb52d8668421f568afa14e92bebe0838c2e922e8aec
                      • Instruction Fuzzy Hash: 17A16D32205A4182EB669F2BD4947AD73A0F78DFE4F048525BB5A4BBB4CF3AC454C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MetricsSystem$Rect$ClientIconicScreenVisibleWindow
                      • String ID:
                      • API String ID: 1122842830-0
                      • Opcode ID: 0d62277aaf98e1e3bc2b8ba5dacf9c917d75718b7bfc5a6a32e31e4fa9d790b9
                      • Instruction ID: 4b60ed3752cabc6faebf2688e8475aa4006138fbef26ea1cd1d72cb0bc848893
                      • Opcode Fuzzy Hash: 0d62277aaf98e1e3bc2b8ba5dacf9c917d75718b7bfc5a6a32e31e4fa9d790b9
                      • Instruction Fuzzy Hash: 59512732310A5086EB569B66D8947ED23A4F78CFC8F448126FF5A87AA4EF38C545C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Parent$RectWindow$Client
                      • String ID: 7
                      • API String ID: 3043635113-1790921346
                      • Opcode ID: e279d00798498cb134c30fe766668d3380d5b9575179136453d05c16733b10d5
                      • Instruction ID: f2c2b328dbb82d146dc5254b2f5b64646e319c68dcba72adff2ea2a7ec4a283e
                      • Opcode Fuzzy Hash: e279d00798498cb134c30fe766668d3380d5b9575179136453d05c16733b10d5
                      • Instruction Fuzzy Hash: DB811276701A4586EB55DF26E858BAE27A4FB8DFC8F049025EF0A47B68DF3AC415C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageObjectSend$MetricsStock$ClientRectRedrawSelectSystemTextWindow
                      • String ID:
                      • API String ID: 1942730005-0
                      • Opcode ID: 67707138812445d9792717b002d93a9c4d2c1380cdac7e36aeb43e13f650ac9a
                      • Instruction ID: 011a15c2e2439beaedf5fd74503d20c21a503fd2c267581f85ec9d54fbd3b5cd
                      • Opcode Fuzzy Hash: 67707138812445d9792717b002d93a9c4d2c1380cdac7e36aeb43e13f650ac9a
                      • Instruction Fuzzy Hash: 21913772711A808BE719CF3AD9847ED77A1F788B99F104125EB1947BA8DF38D865CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientMessageParent$RectSend$ScreenWindow$Post
                      • String ID:
                      • API String ID: 1863548712-0
                      • Opcode ID: b341dc84a516e8ec3788b3d152295bb393972f61a4e4333907dc992a1b6159ed
                      • Instruction ID: 79fc7bdf8f3d1e1247a5786f57d875b3805bbe07d5a747f7dd3e0ee160978559
                      • Opcode Fuzzy Hash: b341dc84a516e8ec3788b3d152295bb393972f61a4e4333907dc992a1b6159ed
                      • Instruction Fuzzy Hash: 4B710576B206508AEB15CF7AE894BDD37B0F788B88F045125EF0A97B68DF34D5058B40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CompatibleCreate$BitmapClipboardDeleteFillOpenRectReleaseWindow
                      • String ID:
                      • API String ID: 458906932-0
                      • Opcode ID: 7d6dfc06b84d7bdc44159752428c13354c754cb9f2c5309785bee35fa84b8073
                      • Instruction ID: 7c7011ed0aa2abadc61e3f504cb25eb3c7a4f3cfddf320e5d7d2fb998d91bca8
                      • Opcode Fuzzy Hash: 7d6dfc06b84d7bdc44159752428c13354c754cb9f2c5309785bee35fa84b8073
                      • Instruction Fuzzy Hash: 7E61733222494192EA62DB27E854BDEA360FBCDB90F405125FB9E876F5DF39C605CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
                      • String ID:
                      • API String ID: 3778485334-0
                      • Opcode ID: de5fadc12308395c65317237703eb135592410b0b349b04363a68763ee18bc46
                      • Instruction ID: fa6acfef4c6eb2a15a31220fb9e2fe9ebdfccfe5abae3c94d1347bcbf65b2e6e
                      • Opcode Fuzzy Hash: de5fadc12308395c65317237703eb135592410b0b349b04363a68763ee18bc46
                      • Instruction Fuzzy Hash: 1E31F735104B8486EB629B56F8987D9B3A4F78CB64F900016DB8E47BB5EFBCC894C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Variant$Clear$ChangeType
                      • String ID:
                      • API String ID: 3653133554-0
                      • Opcode ID: 6eaacb679a0bcc94fcdb2f54fa998455404707e4b5fe17978495d9736b7c3949
                      • Instruction ID: 4469df8593cca6825286f9dc6438fb37f5879381323215473dc747d998de31ab
                      • Opcode Fuzzy Hash: 6eaacb679a0bcc94fcdb2f54fa998455404707e4b5fe17978495d9736b7c3949
                      • Instruction Fuzzy Hash: 9C628A72610A8486EB62CF26D494BDD37A5F798BC8F61412AEB4D47BA8CF34CD85C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: FindPath$CharCloseFileFirstFullInformationNameUpperVolumelstrlen
                      • String ID:
                      • API String ID: 1291283320-0
                      • Opcode ID: d0657d5d2bdd7f3a60a736214990080c5ce23782cfcfa536a1415a863e273ea2
                      • Instruction ID: 7a0f942e3eec21d3e1f9341ea2efae34916521d6a301e4e2b5d743c8ec3a3ed2
                      • Opcode Fuzzy Hash: d0657d5d2bdd7f3a60a736214990080c5ce23782cfcfa536a1415a863e273ea2
                      • Instruction Fuzzy Hash: 7281D532300A0152FA26ABA798587ED6294BB8DBE4F544A19FF69876F5DF38CC458700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: FormatInfoLocaleNumber_cwprintf_s_llstrlen
                      • String ID: KB$%I64d
                      • API String ID: 2697667663-1636307857
                      • Opcode ID: 65bfd6845ed01e35739b0e26cb5970c68473c3a4aa67c2c0b3ce6fdf6311928c
                      • Instruction ID: 81a54eb191ed7492c7e1605f64d185959a1a03433fbb6e57f285c9e4568cff92
                      • Opcode Fuzzy Hash: 65bfd6845ed01e35739b0e26cb5970c68473c3a4aa67c2c0b3ce6fdf6311928c
                      • Instruction Fuzzy Hash: F141C172315A4481EB12AB2BE890BE93761E789FE4F505222EB2E477F5DF38C545C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Redraw$Visible
                      • String ID:
                      • API String ID: 1637130220-0
                      • Opcode ID: 4414306e352575db355f281657eea98b7dd4f9f0169f582cced4c9672310571c
                      • Instruction ID: 265d125d8cac02ecabb0a5487691f60022894b847934b95a1beb9b73f81abc0d
                      • Opcode Fuzzy Hash: 4414306e352575db355f281657eea98b7dd4f9f0169f582cced4c9672310571c
                      • Instruction Fuzzy Hash: 6C416D36311A5086EBA6DB67D4507EA63A4FB8CFC9F148126EF4A4B6B4DF39C4428740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$Parent$RedrawWindow
                      • String ID:
                      • API String ID: 601679388-0
                      • Opcode ID: 10f0eb6dea3327fd3342417ffef694b1c2db9048f75ba0b59f6ac519b1f64455
                      • Instruction ID: 70bc99f407e93e7ccf13e643f1468458614d2dc3ec3c06d04e33f2183f383fde
                      • Opcode Fuzzy Hash: 10f0eb6dea3327fd3342417ffef694b1c2db9048f75ba0b59f6ac519b1f64455
                      • Instruction Fuzzy Hash: 12413C36220A8082EB16DF67E854BA92362FB8DFD8F184525EF0D477B9DE39C4418701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Client$Intersect$EmptyInflate
                      • String ID:
                      • API String ID: 2565724523-0
                      • Opcode ID: 3e2b2ae7ccbb8a7244811b94db8c9312e97ecdb2876fb0328b015749b222f87b
                      • Instruction ID: bf78222b62df833ecb992db1267b68b997d6579d34f513e75771c294aa0826ac
                      • Opcode Fuzzy Hash: 3e2b2ae7ccbb8a7244811b94db8c9312e97ecdb2876fb0328b015749b222f87b
                      • Instruction Fuzzy Hash: 4B42BD32710B90C6EB16CB62E540BED73A0FB88BC8F018126EF4A67BA5DB74C955C744
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: String$From$AllocDialogFreeProgRectWindowmalloc
                      • String ID:
                      • API String ID: 1120981667-0
                      • Opcode ID: 691032ca50baaa47a8d86d342bacb1b658bff73fdd5d9fe6997f1bdef61356a1
                      • Instruction ID: 58405641e73d9caeb7d2368e2ffaedff52a0707cfc9c3f9257335c0c1765294f
                      • Opcode Fuzzy Hash: 691032ca50baaa47a8d86d342bacb1b658bff73fdd5d9fe6997f1bdef61356a1
                      • Instruction Fuzzy Hash: 80D17E76604B908AE715CF6AE4407AE77F1F788B98F104116EF5A87BA8EB38D445CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Menu$Item$Count$MessageSendState
                      • String ID:
                      • API String ID: 1967460588-0
                      • Opcode ID: 41d86fe7f54d3252d8738b246c1117ed89bb23f4d04a181943eae4223287cbcb
                      • Instruction ID: 8a061c0c79c68ebdd250dd7eef4819ebbb099818c0133da1706e10290853a7fd
                      • Opcode Fuzzy Hash: 41d86fe7f54d3252d8738b246c1117ed89bb23f4d04a181943eae4223287cbcb
                      • Instruction Fuzzy Hash: 0771E632221A8182EB679B27D854BEE6390FB8DBE4F141225EF1A977F5CF34C9518740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                      • String ID:
                      • API String ID: 1239891234-0
                      • Opcode ID: 8f360ba3e0e1a3023d794bfdc25d8e406b4aa35c4960f596d1bc53af1efa52dc
                      • Instruction ID: f86b1ef95985370c9b132e6f1eda42c029e2767094bb05384772ba6644bdf1a3
                      • Opcode Fuzzy Hash: 8f360ba3e0e1a3023d794bfdc25d8e406b4aa35c4960f596d1bc53af1efa52dc
                      • Instruction Fuzzy Hash: BD318D32214B808AEB61CF26E8847DE73A4F788B58F540116EB9D47BA9DF38C585CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressCreateHandleInitializeInstanceModuleProc
                      • String ID: AFX_SUPERBAR_TAB$DWMAPI$DwmSetWindowAttribute
                      • API String ID: 3544014753-136793874
                      • Opcode ID: a366edae3fa05eb61f74dc7c665224f5a6b16ab7ac2b41ef08969907bdafbbbf
                      • Instruction ID: 3603b3010496ce36de678ec70b5051e5f27c58998c2c84a9a00741cbeb4072ec
                      • Opcode Fuzzy Hash: a366edae3fa05eb61f74dc7c665224f5a6b16ab7ac2b41ef08969907bdafbbbf
                      • Instruction Fuzzy Hash: C0B15B72301A4186EB569F26C4907DA23A0FB49BE8F049225EB2E47BE9DF38C955C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Virtual$AllocGuaranteeInfoProtectQueryStackSystemThread
                      • String ID:
                      • API String ID: 513674450-0
                      • Opcode ID: f51826e5b3c2b67e3d34fb6dabb49d7077bd84c9cb6993543db56bb348979f64
                      • Instruction ID: e35993bdde3c22ea8bf18f322eb688a3db882136b952ea2849ab48cd11fba7b4
                      • Opcode Fuzzy Hash: f51826e5b3c2b67e3d34fb6dabb49d7077bd84c9cb6993543db56bb348979f64
                      • Instruction Fuzzy Hash: 42315C32310A958AEB65CF32E8947D933A4F74CB88F485426AF0E8BB58DF39D645C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$EmptyRect
                      • String ID:
                      • API String ID: 4004678023-0
                      • Opcode ID: 15c3de08b345170973a13407e9f52af163bb5c730fd04fa8e4e961f861f0e0d9
                      • Instruction ID: fb56e143332ce5409e1fad8b4fc40d774160b12b04d6a98f94a861e668444fe8
                      • Opcode Fuzzy Hash: 15c3de08b345170973a13407e9f52af163bb5c730fd04fa8e4e961f861f0e0d9
                      • Instruction Fuzzy Hash: 3F31B072311A8087FF55CF66E995BEAA3A0FB8DBD5F401111AF5A47AA4CF39C0168700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AsyncRectState$Empty$Invert
                      • String ID: (
                      • API String ID: 3412082714-3887548279
                      • Opcode ID: e91edcdff9ccf23becdba9ec804003742f2a380e0d172c0927b245c270772beb
                      • Instruction ID: 4487b9a79423101ac4961401e6923aecf507cd435446fcaecc94344054772881
                      • Opcode Fuzzy Hash: e91edcdff9ccf23becdba9ec804003742f2a380e0d172c0927b245c270772beb
                      • Instruction Fuzzy Hash: AF026272701A4186EB6AAF3AC5947ED63A1F74CBD4F144126EB1A47BB5CF39C861CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CursorRectStateWindow
                      • String ID:
                      • API String ID: 3412758350-0
                      • Opcode ID: bd46d10739a8afb3bf3f38cc69873ef8307af45e04373baac8fed676a23729fb
                      • Instruction ID: 11f521b3f5ddb2870d6dfaf849c68152ea229bd8867307014647d8c4957afc8c
                      • Opcode Fuzzy Hash: bd46d10739a8afb3bf3f38cc69873ef8307af45e04373baac8fed676a23729fb
                      • Instruction Fuzzy Hash: 9FB1A872310B8186EB5ADF2794887ED27A0BB4CBC8F044425EF59573A5EF36C895C310
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientScreen
                      • String ID: DUMMY
                      • API String ID: 3917795285-3097505935
                      • Opcode ID: 6851958fa95e78564fd732046996a8ad4dfeca168b0d2b196b493a456cca121f
                      • Instruction ID: f0f36c5314db7d97ddc0d18ad439377c318a44a81a500ecb1208022b4f532ab7
                      • Opcode Fuzzy Hash: 6851958fa95e78564fd732046996a8ad4dfeca168b0d2b196b493a456cca121f
                      • Instruction Fuzzy Hash: 33D1AE32311A8086EB25EB27D4507EE63A0FB89BE4F444225EB5E47BE5EF39C944C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: EmptyRect
                      • String ID:
                      • API String ID: 2270935405-0
                      • Opcode ID: 6214fe33e4b44640c4c1801a8b9c85dec5ad0b228751a82b7fa06c2d58e60962
                      • Instruction ID: 32e953d0c8f1bec27451689ee466596d6842724385be6f4391926d3a61628ca4
                      • Opcode Fuzzy Hash: 6214fe33e4b44640c4c1801a8b9c85dec5ad0b228751a82b7fa06c2d58e60962
                      • Instruction Fuzzy Hash: 83A1EF32B10A848AE7199F6AD8503ED77B0F388BD9F044125EF2953BA4DF74D591CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _get_daylight$_errno_invalid_parameter_noinfo
                      • String ID:
                      • API String ID: 3559991230-0
                      • Opcode ID: 60f4f27b565b5e3f257567224cfe6705b79ed811ce1a34dbb63c72a742cf4982
                      • Instruction ID: 45f3f4b56f52016cd0a07df8b55b908a1ea3c8fbc2551ebafde47813afebd97e
                      • Opcode Fuzzy Hash: 60f4f27b565b5e3f257567224cfe6705b79ed811ce1a34dbb63c72a742cf4982
                      • Instruction Fuzzy Hash: 18912972B106414BD72ECB2AED51BD86696F3EC740F588535EF0A8BBE4EB78D9008740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: RedrawWindow
                      • String ID:
                      • API String ID: 2219533335-0
                      • Opcode ID: d420327b0c2e20710e13aeef425d74be4de90289ab916096f6ea3c22917c98ea
                      • Instruction ID: d3b57072ed72b95ecf2322e046e034a057a150d35f9d6b1148a2e964420c7ba5
                      • Opcode Fuzzy Hash: d420327b0c2e20710e13aeef425d74be4de90289ab916096f6ea3c22917c98ea
                      • Instruction Fuzzy Hash: E6417977B10A408BEB54CB66D198BAE33B1F388BD9F554125EF0A07B58CF39C5558B40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: IconicMessagePost
                      • String ID:
                      • API String ID: 288454118-0
                      • Opcode ID: 8ceb3f6354dcbd444a72c1de9b9807b97369e3d7a95ebe2b63d590884671f146
                      • Instruction ID: 196f76cc7b0560501830781cfb8d3bff0ec02929c6b28b7d39540bf8189cc0b3
                      • Opcode Fuzzy Hash: 8ceb3f6354dcbd444a72c1de9b9807b97369e3d7a95ebe2b63d590884671f146
                      • Instruction Fuzzy Hash: 4C21B076614A4586FB769AA6E4843EEA361F38CBC4F144135EF8653BA2DE38C8418340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: IconicVisibleWindow
                      • String ID:
                      • API String ID: 1797901696-0
                      • Opcode ID: d0b243073ec024a855e4704771b3bb3fb9d2ff7626a74cc2401f70e3fc5f614e
                      • Instruction ID: caee6ac879ea5f59b406638ea7ce97ca4a4d2bd6ed3ee10825bc099781813ccd
                      • Opcode Fuzzy Hash: d0b243073ec024a855e4704771b3bb3fb9d2ff7626a74cc2401f70e3fc5f614e
                      • Instruction Fuzzy Hash: 7DF0623031854082E7159B3BAAD03BD6293BBCDBD4F608624FB6D472F5DF34C8464200
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CreateInitializeInstance
                      • String ID:
                      • API String ID: 3519745914-0
                      • Opcode ID: 8ff62f1d93a1f39a369d70547c26b74f26a85472c81fb6d8d60bd986325842fd
                      • Instruction ID: 7cc6f62a34a8725eb9cab78b97b24a6a17e6e7e9d0818e4cff19bb185b9ba2b1
                      • Opcode Fuzzy Hash: 8ff62f1d93a1f39a369d70547c26b74f26a85472c81fb6d8d60bd986325842fd
                      • Instruction Fuzzy Hash: D601FB326156C182EB568B26E5443DD73A0F74CB88F58413AEB084B6B4DF3AD65AC704
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Parent
                      • String ID:
                      • API String ID: 975332729-0
                      • Opcode ID: 3ba6b99948d1c7e67f4518cd5ec6184a019736f4dc0edf478c562aa585bf2c22
                      • Instruction ID: 26a39e9e06644ce6c961481a101ad76d14e644a975b1cfd4bb466e4ea8e69d18
                      • Opcode Fuzzy Hash: 3ba6b99948d1c7e67f4518cd5ec6184a019736f4dc0edf478c562aa585bf2c22
                      • Instruction Fuzzy Hash: C8C16D32311A8182EA66EB27E4547EE63A1FB8DBD4F484125BF5A4B7E5DF38C941C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Color$Text
                      • String ID:
                      • API String ID: 657580467-0
                      • Opcode ID: 341b28d51d463f965b40c4560f645e553d5bf83941e33f815aae2ec0976b49fc
                      • Instruction ID: 6dea8fc57dd88a4bf5bced41691eb4e5f649b63920105b23916b98e3f115e95b
                      • Opcode Fuzzy Hash: 341b28d51d463f965b40c4560f645e553d5bf83941e33f815aae2ec0976b49fc
                      • Instruction Fuzzy Hash: DEA16C73B006508AE762CF7AD8447DD7BA0F78CB98F144219AF4957BA9DB38D980CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Iconic
                      • String ID:
                      • API String ID: 110040809-0
                      • Opcode ID: fb3e903d3760d5398c728c9c8ced5774ae5dd0a55c4aba1ec78d0be3ee1bd993
                      • Instruction ID: 50e268aeed68b0f4f39061ace09dff08a314a3b6b3d1ab73fdfb3b2456ff275d
                      • Opcode Fuzzy Hash: fb3e903d3760d5398c728c9c8ced5774ae5dd0a55c4aba1ec78d0be3ee1bd993
                      • Instruction Fuzzy Hash: C7F01D22714A8181EA95DB67E8443AA6760B78CBC0F548075BB5E87765DF34C5568700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Time$FileSystem
                      • String ID:
                      • API String ID: 2086374402-0
                      • Opcode ID: 84a6c3c29a033bafdea42f0a39ab49030484466b38c60d531c1ee808d3b969de
                      • Instruction ID: 7e15b92b972413aef35f253b0370aeaa00be2005e9261fd750947beeccac3d87
                      • Opcode Fuzzy Hash: 84a6c3c29a033bafdea42f0a39ab49030484466b38c60d531c1ee808d3b969de
                      • Instruction Fuzzy Hash: A9D05E75776584C3DA858F2AEC86A896322F38CB95F901001FA4F43F28CA2CCC17CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 45ca51d4ffef845e7af39127faf1f431dbd7f4dab75556b0c061a503c11a6935
                      • Instruction ID: 6873a219d354d8eb1c7a931844eaee67f6db159661d82c27c55d51013597ec85
                      • Opcode Fuzzy Hash: 45ca51d4ffef845e7af39127faf1f431dbd7f4dab75556b0c061a503c11a6935
                      • Instruction Fuzzy Hash: E3C1F372340A4586EB6ADB2BC4047ED23A2F788BE4F644615EF2A436F5DB7DC881C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 45cb6806c4054104b1560998267f4c41ade1c2e8cbe6e381abbdfbcdff6e5487
                      • Instruction ID: 645ac642489f842f7336a1a5c4983c4aa870af64408fd8b3b69afb4c8dea107d
                      • Opcode Fuzzy Hash: 45cb6806c4054104b1560998267f4c41ade1c2e8cbe6e381abbdfbcdff6e5487
                      • Instruction Fuzzy Hash: 8A715A35300651A6FB62DF3BE950FE62361FBA8798F558025AF09839F5FB31C8458B81
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: free$BoundaryDeleteDescriptorErrorLast_errno
                      • String ID:
                      • API String ID: 2077213501-0
                      • Opcode ID: 7ab6f9aacd4369846c505c836686dfbbf9e437f04a08eab20c60e52b2112374c
                      • Instruction ID: 45e2bf27de56a914cbbf44de08f080a39a4312a2838b0eb4e4e2ed62011ec355
                      • Opcode Fuzzy Hash: 7ab6f9aacd4369846c505c836686dfbbf9e437f04a08eab20c60e52b2112374c
                      • Instruction Fuzzy Hash: 9AA142322616C4C5EB47FA32D8E53EC1322AB88F44F0C8132AB4F5E5B6DE22C845C760
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$ClientWindow
                      • String ID:
                      • API String ID: 23228050-0
                      • Opcode ID: 756f69503740cf9dbbb9334788055bbc16e4f4b65aea04822d6a8cdae31b1561
                      • Instruction ID: 7ddd6b0ee597b23fae15ea2c0de2b4cc712e4c0180e8b281088b6bd9ed5e32b1
                      • Opcode Fuzzy Hash: 756f69503740cf9dbbb9334788055bbc16e4f4b65aea04822d6a8cdae31b1561
                      • Instruction Fuzzy Hash: FBF11436714A418BFB21CF76E884BED33B1A748B88F140616AF5A63BA8DF39D505C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Color$Text$Rect$CompatibleCopyCreateInfoItemMenuMetricsModeSystem$ExtentInflateObjectPoint32wcsnlen
                      • String ID:
                      • API String ID: 2475881999-3916222277
                      • Opcode ID: efdb90a3a5a0d14400ab1d373772124aa4e02a72cc88e5b9db461b2992ff4fae
                      • Instruction ID: 4b68ff7bcad76b05a3b3231e4a898e6b49498b6191608d0f68be6e424ef088be
                      • Opcode Fuzzy Hash: efdb90a3a5a0d14400ab1d373772124aa4e02a72cc88e5b9db461b2992ff4fae
                      • Instruction Fuzzy Hash: 2E126A76214A408BE715DF3AD848BDD77A1F788B98F144215EF4A8BBA8CF79D844CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object$Select$Delete$CompatibleCreate$BitmapCopyImage
                      • String ID:
                      • API String ID: 3904437521-3916222277
                      • Opcode ID: 55458a599a797832ed1a4a444be1e70348ddbf05391a4511bed99d0a1b10e3ce
                      • Instruction ID: 68af51f32060cf68003aec57808cb52f02dce2a09bdf10722cf2b53e173b1291
                      • Opcode Fuzzy Hash: 55458a599a797832ed1a4a444be1e70348ddbf05391a4511bed99d0a1b10e3ce
                      • Instruction Fuzzy Hash: FFC14932215A808AEB169FA6D8847EE73B0F788BD8F444521EF0A5BAB5DF38D545C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressProc$Activate
                      • String ID: BeginBufferedPaint$DrawThemeParentBackground$DrawThemeTextEx$DwmDefWindowProc$DwmExtendFrameIntoClientArea$DwmIsCompositionEnabled$EndBufferedPaint$UxTheme.dll$dwmapi.dll
                      • API String ID: 2388279185-3875329446
                      • Opcode ID: 40f32ea0b0cb1037f7fb039ec9fd6e12348789b417c1e510a83348f68cd74b89
                      • Instruction ID: 10fc8ae7a63e359c28f02ad023ba3009484680be3c57539a6c588be402937d47
                      • Opcode Fuzzy Hash: 40f32ea0b0cb1037f7fb039ec9fd6e12348789b417c1e510a83348f68cd74b89
                      • Instruction Fuzzy Hash: FF31C336601B85D1EB46DF62E8987D823A4FB4CF88F485235EE190B279DF78C699C310
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$ClientContextScreenState$CaptureFocusKillMessageOpenRectReleaseSendStatusTimer
                      • String ID: y
                      • API String ID: 3335632768-4225443349
                      • Opcode ID: 4106064bf8585fa22f5df84f889a1780f33b746706802813b38fec0131cbe041
                      • Instruction ID: 65cabf6e3a5a9194e2385c2b3d415d2f35614891bcacb71feb66ca118ccc4bc9
                      • Opcode Fuzzy Hash: 4106064bf8585fa22f5df84f889a1780f33b746706802813b38fec0131cbe041
                      • Instruction Fuzzy Hash: AFB14675600A0082FB6B9B27D5643EF67A0F78DBC8F104126EB29476F9DF39C8918741
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Message$Peek$Capture$DispatchRelease$CursorSendTranslate
                      • String ID:
                      • API String ID: 605349011-0
                      • Opcode ID: 7cb8c0b11b6e568815ffc8ef306ee75b02231b3ad691da3bbca3ce3ef4463d8e
                      • Instruction ID: b5e2a2abed85c38bf0e3c35d7db9809b6f69f942891fe5dfeb100c3a5b1dd342
                      • Opcode Fuzzy Hash: 7cb8c0b11b6e568815ffc8ef306ee75b02231b3ad691da3bbca3ce3ef4463d8e
                      • Instruction Fuzzy Hash: 7261713131068086FB768F27D8487ED62A1F79CFC5F598029EB4A87AA5DF79C8848740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _errno$_snwprintf_s
                      • String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
                      • API String ID: 3671385064-2801496823
                      • Opcode ID: 728ae87532b5cb506a71af699a030f4b28887c4405e801282e00d74c5d6bb2e0
                      • Instruction ID: b9b7af6a53155cf693547258a769ca208c76c4f7cdd9f3a37e629fce892a0104
                      • Opcode Fuzzy Hash: 728ae87532b5cb506a71af699a030f4b28887c4405e801282e00d74c5d6bb2e0
                      • Instruction Fuzzy Hash: F9516E32200744CAE76AAF6294113DD33A5F78CBC4F894426FB491B7B5CB3AC965C791
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ItemWindow$Long$InvalidateMenuRectShow$Ctrl
                      • String ID:
                      • API String ID: 599340499-0
                      • Opcode ID: b7b436c71b10eecb9f0f326abb0277be2efa4de5ac8f4cf26e87c568c18ccbba
                      • Instruction ID: 0d59f04ab6783d9b8f118bf96fff9081c204c9266b4d480e778efdf175f3912c
                      • Opcode Fuzzy Hash: b7b436c71b10eecb9f0f326abb0277be2efa4de5ac8f4cf26e87c568c18ccbba
                      • Instruction Fuzzy Hash: 65914936201A9486EB569F27D85479933A2FB8DFD4F288925EF1E077A8DF35C8958300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: RectWindow_cwprintf_s_l
                      • String ID: %sPane-%d$%sPane-%d%x$IsFloating$MRUWidth$PinState$RecentFrameAlignment$RecentRowIndex$RectRecentDocked$RectRecentFloat
                      • API String ID: 3874920457-1120251949
                      • Opcode ID: 278ee478880029487aeb6e20192dfed6801563efc00b80b8e4563f05fdfda930
                      • Instruction ID: e737a41b44530619c22297d9d24d5c51611ba07f61d8c8e8394cf12605cbd54f
                      • Opcode Fuzzy Hash: 278ee478880029487aeb6e20192dfed6801563efc00b80b8e4563f05fdfda930
                      • Instruction Fuzzy Hash: 7071567A701B4592EB49DB2AC8487DD27A4FB89FE5F448212EF2A437A4DF34C895C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Inflate$Palette$CreateFill$BrushEntriesIndexNearestRealizeSolidSystem
                      • String ID: iii$
                      • API String ID: 2867256457-462628325
                      • Opcode ID: def1cd46bd3d76d30f5fba5ea1a21a485dfc5eead4d17c7765a6d7d5f4962af3
                      • Instruction ID: 3604e3753e5ce24d57017ed0c0ad34c585eb5bfb1529ea0cc33fdf4404d56c91
                      • Opcode Fuzzy Hash: def1cd46bd3d76d30f5fba5ea1a21a485dfc5eead4d17c7765a6d7d5f4962af3
                      • Instruction Fuzzy Hash: 89914736B00A408AEB12DB66D598BED7361F749BDCF404625EF1917BA8DF388946C780
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l
                      • String ID: %sPane-%d$%sPane-%d%x$IsFloating$MRUWidth$PinState$RecentFrameAlignment$RecentRowIndex$RectRecentDocked$RectRecentFloat
                      • API String ID: 2941638530-1120251949
                      • Opcode ID: 30c8d58875fcbee4f9307f85005a08f97b5b564f0bae113da113d3e6a57f04e4
                      • Instruction ID: 0dc90cbae24b2532efb6d20a30168e264134e0a139232b5c01d624250d1f19a1
                      • Opcode Fuzzy Hash: 30c8d58875fcbee4f9307f85005a08f97b5b564f0bae113da113d3e6a57f04e4
                      • Instruction Fuzzy Hash: D38159B6701B4186EB45DB6AD8487DC23A0F749FE8F459212DE2E577A4DF74C885C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$ClientCreateDesktopFolderMenuParentPopupScreen
                      • String ID:
                      • API String ID: 2994660099-0
                      • Opcode ID: 2c8d0aa70a1d03f0d045baa57d9b429c7708ff5550f2eeb5baaf0972d883519c
                      • Instruction ID: 6673552ca4909417d11dc15da8475683d633e3bf6fbceed879fa31b1c626884b
                      • Opcode Fuzzy Hash: 2c8d0aa70a1d03f0d045baa57d9b429c7708ff5550f2eeb5baaf0972d883519c
                      • Instruction Fuzzy Hash: E7A10376701B0086EB26DFA6E8507DD33A1FB88B98F044225EF0957BA8DF39D859C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CreateRect$BrushSolid$ColorCopyDrawFillFocusFontIndirectObjectlstrcpy
                      • String ID: $
                      • API String ID: 841727867-3993045852
                      • Opcode ID: db99583564949187b9319dd106d4b99a718e0e583d8faffd4e806b12b2f2ffed
                      • Instruction ID: d60c02f383bce62fecd88bc4a0cab7d1b7ce1907f1bf6e15f6c5a3eee40bdda6
                      • Opcode Fuzzy Hash: db99583564949187b9319dd106d4b99a718e0e583d8faffd4e806b12b2f2ffed
                      • Instruction Fuzzy Hash: 1391AC32310A4086EB12DF66D854BDD3371FB88BA8F444126EF1A57BA8DF38C959C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
                      • String ID:
                      • API String ID: 101574016-0
                      • Opcode ID: b29249a283d2891ea17a14ea78d76c6fbb984d3bb27a5b1db12c95115a78bf82
                      • Instruction ID: 631446a8cf12c37cf44a61eecd3a2664da807abad7f2603f4578f14bc92ecb15
                      • Opcode Fuzzy Hash: b29249a283d2891ea17a14ea78d76c6fbb984d3bb27a5b1db12c95115a78bf82
                      • Instruction Fuzzy Hash: 6EA1D33121174047FA17AB57AD103EA2695BB4CFA4F988A269F5E4B7F5DF3DC8218B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Capture$ClientEmptyMessageMetricsReleaseSendSystem$InvertRedrawWindow
                      • String ID:
                      • API String ID: 1941718639-0
                      • Opcode ID: dd84e7ac3c97d3ba8efe919b3517654a5311a42713cf9e01754b60231d6dc4e9
                      • Instruction ID: e7d2199b1de3808fcda1ca808bc9a859208d4748ce4b207675130c03cc15b3ce
                      • Opcode Fuzzy Hash: dd84e7ac3c97d3ba8efe919b3517654a5311a42713cf9e01754b60231d6dc4e9
                      • Instruction Fuzzy Hash: 3351F136210A44CAE725DF3AE88479E77A1F78CB89F455225EF4A43B68CF39D841CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: RedrawWindow
                      • String ID: MFCPropertyGrid_AlphabeticMode$MFCPropertyGrid_DescriptionArea$MFCPropertyGrid_DescriptionRows$MFCPropertyGrid_HeaderCtrl$MFCPropertyGrid_ModifiedProperties$MFCPropertyGrid_VSDotNetLook$Property$Value
                      • API String ID: 2219533335-2695045869
                      • Opcode ID: 1739f536e81f9766bd094036aaf26d1998f05c4c9c2938f9be68fc889b3743fd
                      • Instruction ID: 6da66f977703b521301d13311a5a3f31ce193895d8e17b955b35ae7b219f6fa3
                      • Opcode Fuzzy Hash: 1739f536e81f9766bd094036aaf26d1998f05c4c9c2938f9be68fc889b3743fd
                      • Instruction Fuzzy Hash: D9518172B00A4596FB01EF7AD8407DD23A1BB897E8F445226EF2A576E9DF38C845C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • GetObjectW.GDI32(?,?,?,?,?,?,00000000,000000014001335F,?,?,?,0000000140008154), ref: 00000001400DE184
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object
                      • String ID:
                      • API String ID: 2936123098-3916222277
                      • Opcode ID: 50f25406d6000e54a53536f177f600985c5a6548ffaf36ff70181feb47b730a4
                      • Instruction ID: d243b626481a253976a66f4cba7e936815e066a77f0c4e4019342b6946c79963
                      • Opcode Fuzzy Hash: 50f25406d6000e54a53536f177f600985c5a6548ffaf36ff70181feb47b730a4
                      • Instruction Fuzzy Hash: 26515E72701A408AFB21EF66D8947ED73A0FB48B98F404525EF195B7A9DF34C905C350
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Inflate$Create$BrushCompatibleDrawFillFocusHatch
                      • String ID: iii$
                      • API String ID: 1827052314-462628325
                      • Opcode ID: a1c84c689e1a6aed45395366514775e6798c8e4c9f1e8c8891c6c80769142bbc
                      • Instruction ID: f2445e5f08dcdc5ff099eb4aa084456abdb134f8726f58e8febe4e2ab6e1acaf
                      • Opcode Fuzzy Hash: a1c84c689e1a6aed45395366514775e6798c8e4c9f1e8c8891c6c80769142bbc
                      • Instruction Fuzzy Hash: 585149327206608AE712DB67E948BDC7365F34DBE8F404226EF1A13BA4CB79C945CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Create$EqualWindow$CombineIndirectRedraw
                      • String ID: X
                      • API String ID: 1400420921-3081909835
                      • Opcode ID: 0de9bcd5db356a5841b8971ca76c0b54e03f7c8ee6bee98acac6de56935c9ed0
                      • Instruction ID: cbd9ae6d8f7796cc3cc42fa539bc4efc0af9ba1316ebfeb33be6a29014d1f98d
                      • Opcode Fuzzy Hash: 0de9bcd5db356a5841b8971ca76c0b54e03f7c8ee6bee98acac6de56935c9ed0
                      • Instruction Fuzzy Hash: 6B515A767106908AF715DF66E948BEE7760F74CB98F048224DF5917AA8DF38E494CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Path$File$FreeRemoveSpecTask$Findwcsnlen$ExtensionName
                      • String ID:
                      • API String ID: 1633840222-0
                      • Opcode ID: 203828cef36641f4b9a3a2094d02f4f1777f7050d31689e4018c1f39df920277
                      • Instruction ID: 870b0453b46a32a6cd2bf88187d94c00e8a2eee05fd07763d02dc2b0ddf19673
                      • Opcode Fuzzy Hash: 203828cef36641f4b9a3a2094d02f4f1777f7050d31689e4018c1f39df920277
                      • Instruction Fuzzy Hash: 7D122376701A058AEB05EF2AD8903ED23A1FB89F98F244512EF1E577A8DF38C855C750
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ItemMenu$Enable$Check$UpdateWindow
                      • String ID:
                      • API String ID: 2733832559-0
                      • Opcode ID: 8714fc4b496b7fb7fbfad6f209ae1ea7c7afd6051f1558758ae806c838106282
                      • Instruction ID: c231bd1814412e9da5982cc605ca2cdb6bcee4bbc2daf34c8bf173d1ee0a820a
                      • Opcode Fuzzy Hash: 8714fc4b496b7fb7fbfad6f209ae1ea7c7afd6051f1558758ae806c838106282
                      • Instruction Fuzzy Hash: 3CC1563630068086EB2A9F27C5847EA63A1F78CFD4F15A135EF19077B4CB79D8668748
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$CopyParentWindow
                      • String ID:
                      • API String ID: 642869531-0
                      • Opcode ID: f4b99205baa2157d043a506a127d10d146891247f2de2665d9611672f6bba5e6
                      • Instruction ID: 05a2e5b23c2e4046ba52521713c9760659f8d545cbdfe3a28ec81119516ef074
                      • Opcode Fuzzy Hash: f4b99205baa2157d043a506a127d10d146891247f2de2665d9611672f6bba5e6
                      • Instruction Fuzzy Hash: 66B1E572B10A118EEB56CF6AD8847DD37B0F749788F55411AEF0A93B68DB38D845CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$CursorInfoMonitor$CopyEqualExtentFromInvalidateLoadParametersPointPoint32SystemTextUpdateWindow
                      • String ID:
                      • API String ID: 321205079-0
                      • Opcode ID: a24fea1ae43aefb815c0465a16cfca4d278852ae171f51bd85c4b94086aabfda
                      • Instruction ID: b2e85528f3c787adf9936372c6194d9ad56a07712c16c0c830ecce1ddbee5c1e
                      • Opcode Fuzzy Hash: a24fea1ae43aefb815c0465a16cfca4d278852ae171f51bd85c4b94086aabfda
                      • Instruction Fuzzy Hash: 7DB18872B006418BEB1ACFBAD5847EC77A1F74CB98F048125DB095B6A9EF38D855CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MetricsSystem$VisibleWindow$Zoomed
                      • String ID:
                      • API String ID: 331015031-0
                      • Opcode ID: a0cde800b29f3990bfb8abdeecc300f6d74fd8db95b3a0c0a0ffa2e4d1ff5a5a
                      • Instruction ID: 0f557c792f48cc14f681f5fcd19b0006c472fd2b4db25870d2e0be5932c00eb3
                      • Opcode Fuzzy Hash: a0cde800b29f3990bfb8abdeecc300f6d74fd8db95b3a0c0a0ffa2e4d1ff5a5a
                      • Instruction Fuzzy Hash: 4C51FC36210B848AEB969F27D4543ED73A4F788FC8F548039EB4A872B5EF34C8818351
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Thread$ActiveCaptureCurrentDesktopFromPointProcess
                      • String ID:
                      • API String ID: 1298419125-0
                      • Opcode ID: 300c48814a5ed2d3c0e3c3f5167d966ebfca743e6d387502f53e607a9311c126
                      • Instruction ID: 90fa10f691dac64a6f3197af1c7c4ab3eb72548e9eb6d7d4c5fe58fea1994db8
                      • Opcode Fuzzy Hash: 300c48814a5ed2d3c0e3c3f5167d966ebfca743e6d387502f53e607a9311c126
                      • Instruction Fuzzy Hash: 2F31433120175585FE67AB63A8587E962A0BB8DFD4F090829EF0A037B6DF78DC91C201
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Invalidate$Window$Proc
                      • String ID:
                      • API String ID: 570070710-0
                      • Opcode ID: 621e5bd63ea12edcd1fad511d68109cecfaba83a77baf59a27c5be1f0f5ed7d5
                      • Instruction ID: 3d8a9e9ba62f9f6cf5b0fdccbedefbec3759bfe9cf6e8cdbeb5f23a84001ba7f
                      • Opcode Fuzzy Hash: 621e5bd63ea12edcd1fad511d68109cecfaba83a77baf59a27c5be1f0f5ed7d5
                      • Instruction Fuzzy Hash: 48413436710A248AFB228B66E988BDD37B1F78CB88F444101DF0917A68DF79D655CB50
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l$Windowfree
                      • String ID: %sMFCToolBar-%d$%sMFCToolBar-%d%x$Buttons$Name
                      • API String ID: 1266699259-3132478384
                      • Opcode ID: e825c563f0c1f9d67111bb7fe540b15cde5a1086fa6c1727f4f7c48790c4fe40
                      • Instruction ID: 679fd13db3dc9e3e7543d44d530fe959eaf7445556e3bffdd913e36cf23d4e10
                      • Opcode Fuzzy Hash: e825c563f0c1f9d67111bb7fe540b15cde5a1086fa6c1727f4f7c48790c4fe40
                      • Instruction Fuzzy Hash: 7381A272201A4182EB16AB2AE4503DE6760FB89FE4F459626EF5E477F5DF38C445C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageProcessSendWindow$ActiveCurrentFocusParentThread
                      • String ID:
                      • API String ID: 4099184364-3916222277
                      • Opcode ID: 8188678389c932b744aad178a7f20dea6a01c79d06244ac488b5d24346ab1f74
                      • Instruction ID: c9576e1e6346dde1fdfee2705cccc488544e3329bbf44d1fed4c9126d86366d3
                      • Opcode Fuzzy Hash: 8188678389c932b744aad178a7f20dea6a01c79d06244ac488b5d24346ab1f74
                      • Instruction Fuzzy Hash: B5318D36710A8486EB56CF37E8447D937A2FB89F88F684524EB4A476B4CF3AC845C701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object$Stock$CapsDeviceRelease
                      • String ID: System
                      • API String ID: 46613423-3470857405
                      • Opcode ID: d306a73af0cf83b75a05bc0b3be5f7bd22a43fcaadf8b72a3b4787169c3224a1
                      • Instruction ID: e0e26129c3f602026b34bc035f8b1bd9754756c0f12a23f70040f8742f075c26
                      • Opcode Fuzzy Hash: d306a73af0cf83b75a05bc0b3be5f7bd22a43fcaadf8b72a3b4787169c3224a1
                      • Instruction Fuzzy Hash: 02213931304B4496EB669B22F858B9A73A1F74CF84F444529EE9A47BA8DF3CD945CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: UpdateWindow$BeepClientMessageScreen
                      • String ID:
                      • API String ID: 1712693409-0
                      • Opcode ID: f58da98ef6ae06a60e2436be4e73b00f9b7007941ae3e4d9fe19e1f733730342
                      • Instruction ID: 7281d45bee94c51e7cad4e12acb5b13ea28cb6e878d26a94a5616cb72a0ac4f1
                      • Opcode Fuzzy Hash: f58da98ef6ae06a60e2436be4e73b00f9b7007941ae3e4d9fe19e1f733730342
                      • Instruction Fuzzy Hash: 6C814836700A4086EB16DF63E8547ED23A1F789BD8F554135EF0A4BBA8DF38C8558744
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object
                      • String ID:
                      • API String ID: 2936123098-0
                      • Opcode ID: ee0a9c45f23a533de5ae17e12e61c1336b0051b82d4bae1bd7fa6358fec4fa27
                      • Instruction ID: 11a0f36c691e3205b78ab3bf900d5cd773b9b890ff61657e2d218c91239777a0
                      • Opcode Fuzzy Hash: ee0a9c45f23a533de5ae17e12e61c1336b0051b82d4bae1bd7fa6358fec4fa27
                      • Instruction Fuzzy Hash: C4616032314A8086E7229F5BE44479AA7B0F78DBD4F544125FF4A977B4DB3DC9458B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Menu$Item$Count$AppendInsertStateString
                      • String ID:
                      • API String ID: 420201382-0
                      • Opcode ID: 2168daf55ab128776337c7c5f1d19977117434ef8df0735fdc9d38185cb8695d
                      • Instruction ID: 005ca6a1c972cca4da3538d492dadd42fed747a9a858133f4d08096823ac554d
                      • Opcode Fuzzy Hash: 2168daf55ab128776337c7c5f1d19977117434ef8df0735fdc9d38185cb8695d
                      • Instruction Fuzzy Hash: AB61BF32614A8086E722CF16E84479BB7A0F789BD9F100111FF9A4BBB8CF79C445CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Invalidate$Empty
                      • String ID:
                      • API String ID: 1126320529-0
                      • Opcode ID: c8853c6a5d58490479b13141c2eba7f4bd6b85b1a11f62bbcf9f39745dead602
                      • Instruction ID: 528ed229029bb9fa0450e8aa8b1ef25244967332e46b2fc6b4e9e3b2eec29de9
                      • Opcode Fuzzy Hash: c8853c6a5d58490479b13141c2eba7f4bd6b85b1a11f62bbcf9f39745dead602
                      • Instruction Fuzzy Hash: 23714836B10A548AEB568F66C9847EC33B0F788F99F148125DF0A67B68DF39C485C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CaptureClientMessageMetricsScreenSendSystem$FocusRelease
                      • String ID:
                      • API String ID: 3871486171-0
                      • Opcode ID: e3313711170ec6e88c5753584dc6fc68a2a834c42e4e0f41d1eadc27a8ca286f
                      • Instruction ID: 5acb5cbb5e9497cfd8df5076e1a8d34a6c1c5b0fa2302872d372f2c7b9c1b670
                      • Opcode Fuzzy Hash: e3313711170ec6e88c5753584dc6fc68a2a834c42e4e0f41d1eadc27a8ca286f
                      • Instruction Fuzzy Hash: 48513732211B8086EB668F2AD9807EC67A1F78CBD8F250526FF1E477A5DF35C8918740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientKillScreenTimerWindow$ActiveCaptureChildCursorForegroundFromLastPointPopupState
                      • String ID:
                      • API String ID: 3566347107-0
                      • Opcode ID: af16cb61ef9677b338bd15afe49513efe74ceef247cdc94d2348ec10fab62a6d
                      • Instruction ID: afdac9210b5123e9565ff34a2f3efee621f099c55fa44b3e15ba6806e72aa7fa
                      • Opcode Fuzzy Hash: af16cb61ef9677b338bd15afe49513efe74ceef247cdc94d2348ec10fab62a6d
                      • Instruction Fuzzy Hash: F8512736201A6482EF16DB23E8547A96691FB88FE4F055621EF2E0BBE9DF39D5458300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Update$Lock$RectValidate$Show
                      • String ID:
                      • API String ID: 3683107044-0
                      • Opcode ID: 6fedc6c34b7b2726f3e567b4e01c4679ac9400cbf5f5d85e3615daf22c1d59f0
                      • Instruction ID: 484ce94ac611cf3b2522f0a1ad4813e0b5a04306b8bf24b511bde86285cb6ae3
                      • Opcode Fuzzy Hash: 6fedc6c34b7b2726f3e567b4e01c4679ac9400cbf5f5d85e3615daf22c1d59f0
                      • Instruction Fuzzy Hash: 19514D71240A9186EB6A9B17D9543EA6362FB8CFC4F288825EF1D477B9DF39C551C300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$EmptyInvertMessageMetricsSendSystem$Client
                      • String ID:
                      • API String ID: 3620722296-0
                      • Opcode ID: 8123c73eef85e21c324699e6a3dd7a59e9e4b5bede921260e2acc41e60911ead
                      • Instruction ID: 577d817ec5f8a71af152ff765630c05c301b9fa7496dfd9c7f031e8f713da769
                      • Opcode Fuzzy Hash: 8123c73eef85e21c324699e6a3dd7a59e9e4b5bede921260e2acc41e60911ead
                      • Instruction Fuzzy Hash: 39513A32610A80CAE725CF76E8847DE73A0F78CB99F415225EF5A836A4EF38D405CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _errno$_invalid_parameter_noinfo
                      • String ID:
                      • API String ID: 2819658684-0
                      • Opcode ID: a3e37573e1f87a9b521d3896c1b3318f2d53cd3f9b7653475e4b1230597c3534
                      • Instruction ID: 9b8a16b034ffc8f44c43a6426637c71aa92dbfcb9b472b1c9678d4ed7646cdb4
                      • Opcode Fuzzy Hash: a3e37573e1f87a9b521d3896c1b3318f2d53cd3f9b7653475e4b1230597c3534
                      • Instruction Fuzzy Hash: 4831A171500B4085EB22AF63D5A03DE76A0AB5CFE8F584211EF6A0B7F6DB3AC4408751
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Global$Size$LockUnlock$Allocmemcpy_s
                      • String ID:
                      • API String ID: 2627076235-0
                      • Opcode ID: 1f91fb0e81f23c917aa2552c6b63a909cf01b1278318c3275aee6a1ef6c4f1c8
                      • Instruction ID: 45797eda34b2dbbba1c9815c5a50adb32fbe37c77c6a9e48ee732dddccb05a9b
                      • Opcode Fuzzy Hash: 1f91fb0e81f23c917aa2552c6b63a909cf01b1278318c3275aee6a1ef6c4f1c8
                      • Instruction Fuzzy Hash: 0A215934205B5586FB5AAF5368987A862E5BB8EFC0F580425FF4A8BBB5DF39C4418301
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$EmptyInflate$ExtentOffsetPoint32Text
                      • String ID: mmm
                      • API String ID: 3048652965-1545505134
                      • Opcode ID: 18d984b26ea760f3407292905b27f4e48255401e2158999fb1d3011f1ce32fe8
                      • Instruction ID: 780233ebb9d0685ba387a3ef8e1b31319faa0b883eea6ff17dda03a02a63fcec
                      • Opcode Fuzzy Hash: 18d984b26ea760f3407292905b27f4e48255401e2158999fb1d3011f1ce32fe8
                      • Instruction Fuzzy Hash: 5302AD73600B858AEB65CF3AD4447DD37A5F788B98F084625EF4A57AA8CF38D581CB10
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: String$Alloc$CreateFreeGuid_cwprintf_s_lmemcpy_s
                      • String ID: %08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X$RestartByRestartManager
                      • API String ID: 2811436864-5890034
                      • Opcode ID: 3ed39084595278ba7e0d3f18d422813546c5a66ee7f65fb9010b453d0cfb18fc
                      • Instruction ID: fb83c43bc4e28b71882c420608d5fe02d8c7318f38a15c980b2f7762212ee737
                      • Opcode Fuzzy Hash: 3ed39084595278ba7e0d3f18d422813546c5a66ee7f65fb9010b453d0cfb18fc
                      • Instruction Fuzzy Hash: 3FC19DB2701A4186EB15DF26E8503ED77A0FB49BA8F454225EF1E47BA6EF38C844C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CompatibleCreate
                      • String ID:
                      • API String ID: 3111197059-3916222277
                      • Opcode ID: 59cf212ac7441860e131e8db5188ad40edb8737d0632140132c3e4fe129e5a95
                      • Instruction ID: 6d1d7bd4ebf8212b90acbc7432a673478b4a4a238ebf3bf08163339981b6f9bc
                      • Opcode Fuzzy Hash: 59cf212ac7441860e131e8db5188ad40edb8737d0632140132c3e4fe129e5a95
                      • Instruction Fuzzy Hash: 77B19E72705A508AE712DF76D4503ED37A2FB88BD8F408126EF499BBA9DB34C906D740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientRectScreenWindow$CaptureEmptyRedraw
                      • String ID: '
                      • API String ID: 1696171173-1997036262
                      • Opcode ID: ebc59a1167ba7d8edff8540cd21ad9bff83d012cbf9883fc92a188adbbdbc42a
                      • Instruction ID: f6b40e856ed67753d1f3bbfffe14b4d14d82c3a5dc142f0b9bd1a4ef477995b3
                      • Opcode Fuzzy Hash: ebc59a1167ba7d8edff8540cd21ad9bff83d012cbf9883fc92a188adbbdbc42a
                      • Instruction Fuzzy Hash: BF31AB72210681D7EB19DF76E598BDDB360F788B88F148129EB0A47664EF39C065CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Create$Timer$Indirect$CombineCopyCursorFocusInflateIntersectKillMessageParentReleaseSendUpdateWindow
                      • String ID:
                      • API String ID: 1486959152-0
                      • Opcode ID: 1c78602588aae895dcecf81131eb193ceecce5f51a5c3f19b41d648a45c3866e
                      • Instruction ID: d88fd48ac49751da522126159d23be18717c14a5328b0ddab1e48612cca584ec
                      • Opcode Fuzzy Hash: 1c78602588aae895dcecf81131eb193ceecce5f51a5c3f19b41d648a45c3866e
                      • Instruction Fuzzy Hash: 1CE17B322006818AEB66AF26D4803EC33E1F349FD9F194136EF0A5B7B6DA74C895C754
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d7117f623f8de2277ff3ef181a0b36043e08fff7f49fda5344cc8b9d016c82e4
                      • Instruction ID: 012b3f8ba39038e786fadebdba5bfb43b6b67d068d9155a3de70a35183a3347c
                      • Opcode Fuzzy Hash: d7117f623f8de2277ff3ef181a0b36043e08fff7f49fda5344cc8b9d016c82e4
                      • Instruction Fuzzy Hash: 3EB19132600A5582EB579FABD4143EE67A0F788FC8F558522EF161BBB8CF78D8458341
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ObjectSelect$CreateSection$CompatibleCriticalRect$EnterLeaveOffsetWindowfreemalloc
                      • String ID:
                      • API String ID: 4129283992-0
                      • Opcode ID: c8f949fdd636239690f01b9ec7daa6bece24544e18a57dd16f4c8162c5e5e4ea
                      • Instruction ID: de3e3a21cfc2feab22073569751725b0de19ae24f3864073b15ce8a40efa60cb
                      • Opcode Fuzzy Hash: c8f949fdd636239690f01b9ec7daa6bece24544e18a57dd16f4c8162c5e5e4ea
                      • Instruction Fuzzy Hash: 01C149326146808AEB22DF7AD8507DEB7A0F798BD8F144216FF5957AB9DB34C941CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: wcsnlen$MessageParentSend$FreeTask
                      • String ID:
                      • API String ID: 656347825-0
                      • Opcode ID: c289686658484abbb867155f782eb1502dc1c463b6953d3513adc29c23ae8279
                      • Instruction ID: 0a979c0cf749e10137557447ec49781ed97d8b5d53bc1e0ba0a75ea38170915a
                      • Opcode Fuzzy Hash: c289686658484abbb867155f782eb1502dc1c463b6953d3513adc29c23ae8279
                      • Instruction Fuzzy Hash: FDA18A72700A4186EB06EF66C8443EC2762FB8ABD8F244515EF1E973A9DF39C955C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$DeferRect$BeginClientCopyCtrlMessageSend
                      • String ID:
                      • API String ID: 1228040700-0
                      • Opcode ID: 913b3f66cf97b12bebfaf40245b2ff5e2d46b33f1fd8225c90d06645bb4d5431
                      • Instruction ID: 7ae4d60b9f7a9b8c3a49624ba1f1a60aaad9594884c949e3534a14a977e300a5
                      • Opcode Fuzzy Hash: 913b3f66cf97b12bebfaf40245b2ff5e2d46b33f1fd8225c90d06645bb4d5431
                      • Instruction Fuzzy Hash: DD512976B106508AFB56CFA6E8407ED33B1B74CB98F148415EF0A27B68DB34C842E740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Parent$DestroyMessageSend
                      • String ID:
                      • API String ID: 2635554982-0
                      • Opcode ID: 023c990ecd6356101d1f8c4092e24c585cd08113c6b97c1cfa8caf4ed2933a73
                      • Instruction ID: 882c437b23a1e123c176d6a394ca7a51cd9be9d987321a0a5e62df4a739bd141
                      • Opcode Fuzzy Hash: 023c990ecd6356101d1f8c4092e24c585cd08113c6b97c1cfa8caf4ed2933a73
                      • Instruction Fuzzy Hash: EB615532605B8082EB66DF23D5947AA23A0FB98FD4F184625EF1E0B7B9DF39C4418740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: RectSystem$CopyInfoMetricsMonitor$FromParametersPointWindow
                      • String ID:
                      • API String ID: 1563237627-0
                      • Opcode ID: 9650f0cc369068b94f8285af703433f6253af8bdb5e73b27170d1ab8a0ae76f4
                      • Instruction ID: faa99096855647ea24341fc1bda6ffca171c1d1adc881d948110d5aec8a22eb0
                      • Opcode Fuzzy Hash: 9650f0cc369068b94f8285af703433f6253af8bdb5e73b27170d1ab8a0ae76f4
                      • Instruction Fuzzy Hash: 1C611572A10640DEEB19CF7AC8597ED77B1F74878DF048425EB0897AA8DB34D654CB80
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$CaptureDestroyEmptyMessageParentPointsRectReleaseSendVisible
                      • String ID:
                      • API String ID: 3509494761-0
                      • Opcode ID: 2215e8138798c27f1a432551d078fe0dad6849549f7d55408fcab0aca2c83251
                      • Instruction ID: 221a9eb68353e394afbd383c1101a0657aa31a314b091333a97e216dd7f1fa00
                      • Opcode Fuzzy Hash: 2215e8138798c27f1a432551d078fe0dad6849549f7d55408fcab0aca2c83251
                      • Instruction Fuzzy Hash: 51515732315B9485FB6A9F66D8597E923A0FB88FC8F084135EF4A476A9DF38C445C350
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$MessageSend$CaptureKillParentRedrawReleaseTimer
                      • String ID:
                      • API String ID: 3014619129-0
                      • Opcode ID: cf3942302110c3a5c99bc117241b9d2975e42948e8a1a7e4df2b9ffc3fc51bf0
                      • Instruction ID: 8006debe16f77e1ace78ae4890985e8573e29cc1b2a989bbc1eb8c8d2de584db
                      • Opcode Fuzzy Hash: cf3942302110c3a5c99bc117241b9d2975e42948e8a1a7e4df2b9ffc3fc51bf0
                      • Instruction Fuzzy Hash: FE417837201781C6EBAA8B23D9557E932A5F78CFC4F284125EB8507B61CF35C6A2CB51
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _errno$FocusMessageSendTextWindow_snwscanf_wcsftime_lvscan_fn
                      • String ID:
                      • API String ID: 642130051-0
                      • Opcode ID: 3788094aa3d03fb3c9fdaf071a37c376cead2ec43f7ab3eeb626562483b4d6c1
                      • Instruction ID: d2d2cc61f318abc07b5958f35fae14d8618c2e2e7d60e73d04d7a4340c51815a
                      • Opcode Fuzzy Hash: 3788094aa3d03fb3c9fdaf071a37c376cead2ec43f7ab3eeb626562483b4d6c1
                      • Instruction Fuzzy Hash: CC319E3221124096FB67AF67E815BDE3260A78DBC4F484121FB590B7E6CF3AC985CB11
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Client$PointsWindow$ParentScreen
                      • String ID:
                      • API String ID: 1944725958-0
                      • Opcode ID: b7436ac9e9607255edaef33c35541d0b17286ed5a0a7da14b6215fd3389bf361
                      • Instruction ID: 95cc6cf0fcbbfcfcc33a7dba0f54aad7b1923369e4cf3aea18afb31d08f894f5
                      • Opcode Fuzzy Hash: b7436ac9e9607255edaef33c35541d0b17286ed5a0a7da14b6215fd3389bf361
                      • Instruction Fuzzy Hash: C7310472711A0586EF129B66E8543ED23A0FB8CFD9F080425EF0E57B69EF38C5058380
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Menu$CountItem
                      • String ID:
                      • API String ID: 3435231853-0
                      • Opcode ID: dbb7245e59f68b48379254d5f56623765e2b2a0d6a4fa26e8da4bc9b54366c47
                      • Instruction ID: 3cd607bf038f7b67848a1ecd878e651acfe601dd0ef319e595bf931e229d047d
                      • Opcode Fuzzy Hash: dbb7245e59f68b48379254d5f56623765e2b2a0d6a4fa26e8da4bc9b54366c47
                      • Instruction Fuzzy Hash: 74218E34304A1587FB179FA7B8907AA52A2B78CFD8F644425BF064B775DE7AC856C300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • _FF_MSGBANNER.LIBCMT ref: 000000014015E41F
                        • Part of subcall function 0000000140159F5C: _set_error_mode.LIBCMT ref: 0000000140159F65
                        • Part of subcall function 0000000140159F5C: _set_error_mode.LIBCMT ref: 0000000140159F74
                        • Part of subcall function 0000000140159CFC: _set_error_mode.LIBCMT ref: 0000000140159D41
                        • Part of subcall function 0000000140159CFC: _set_error_mode.LIBCMT ref: 0000000140159D52
                        • Part of subcall function 0000000140159CFC: GetModuleFileNameW.KERNEL32 ref: 0000000140159DB4
                        • Part of subcall function 00000001401558F8: ExitProcess.KERNEL32 ref: 0000000140155907
                        • Part of subcall function 000000014015C584: malloc.LIBCMT ref: 000000014015C5AF
                        • Part of subcall function 000000014015C584: Sleep.KERNEL32(?,?,?,000000014015E459,?,?,00000000,000000014015E503,?,?,00000000,000000014015A9F9,?,?,00000000,000000014015AAB0), ref: 000000014015C5C2
                      • _errno.LIBCMT ref: 000000014015E461
                      • _lock.LIBCMT ref: 000000014015E475
                      • InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000000,000000014015E503,?,?,00000000,000000014015A9F9,?,?,00000000,000000014015AAB0,?,?,00000018,0000000140156059), ref: 000000014015E48B
                      • free.LIBCMT ref: 000000014015E498
                      • _errno.LIBCMT ref: 000000014015E49D
                      • LeaveCriticalSection.KERNEL32(?,?,00000000,000000014015E503,?,?,00000000,000000014015A9F9,?,?,00000000,000000014015AAB0,?,?,00000018,0000000140156059), ref: 000000014015E4C0
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
                      • String ID:
                      • API String ID: 113790786-0
                      • Opcode ID: b5d6b5fb549fee16f5460b080848d2d4ba3f68f4d2b6330bf83364b9fc4a52b8
                      • Instruction ID: 5d5a96fed3c1ebfac2292d10fd1d2795d2d73bf3692a58e8241d238a53045681
                      • Opcode Fuzzy Hash: b5d6b5fb549fee16f5460b080848d2d4ba3f68f4d2b6330bf83364b9fc4a52b8
                      • Instruction Fuzzy Hash: DD218431A5164081F76BAB23E4947EE62D5E78CF94F4C4424A74A8F6F2CF7DC8408751
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: System$InfoParameters$Metrics$DisplayEmptyEnumMonitorsRect
                      • String ID:
                      • API String ID: 2614369430-0
                      • Opcode ID: 49ccd609a4ffd96ab8f54e4b0ee883f6608fdf69b43f4e9097255c2c25349996
                      • Instruction ID: 68550a79694932581bb3c1d4ff8d87e2623c55c808519eadf8d506b2d89c8506
                      • Opcode Fuzzy Hash: 49ccd609a4ffd96ab8f54e4b0ee883f6608fdf69b43f4e9097255c2c25349996
                      • Instruction Fuzzy Hash: B9213B326106C1E7F70E8F72EA587D9B7A1F788749F408019D75A076A0CF79907ACB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MetricsSystem$ClassLongMessageSend$DrawExtentIconParentPoint32Text
                      • String ID:
                      • API String ID: 928954478-0
                      • Opcode ID: 1aa1d5571cb23486355a365294de46c71005d604385011ec10c4f151eb02f09a
                      • Instruction ID: c19a0a1c0a9d0a677418b162b5fd142c49a2f2e44909df353cad40acc97da41c
                      • Opcode Fuzzy Hash: 1aa1d5571cb23486355a365294de46c71005d604385011ec10c4f151eb02f09a
                      • Instruction Fuzzy Hash: 1E917B76710A418AEB05DF7AD4947AD33A1F788BD8F408229EF5A93BA4DF38C845C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressProc$ActivateClientScreen
                      • String ID: CloseGestureInfoHandle$GetGestureInfo$user32.dll
                      • API String ID: 2781704992-2905070798
                      • Opcode ID: db3c86669cde7c6a3b6e5feed30116c2b0e0d2b7393cae35b3be7e6939e19c81
                      • Instruction ID: 5f465e7d75fb43c67b765eb27429842ebc406e842babc2d0c37685d347f07839
                      • Opcode Fuzzy Hash: db3c86669cde7c6a3b6e5feed30116c2b0e0d2b7393cae35b3be7e6939e19c81
                      • Instruction Fuzzy Hash: E78102B6212B8485EB56DF27E8447A937A4F748FE8F084226EE1A577B4DF34C9418740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: memmove_s$GlobalLocklstrlen
                      • String ID: System
                      • API String ID: 2064771451-3470857405
                      • Opcode ID: c385fdda561922424afa88111352050d55bff8198f006e60d9eab1b2380f9eea
                      • Instruction ID: a7c3179ae56de31e51e9c4f03522cf1338ec8e00af3fe2413f5d9b8cb6137dd6
                      • Opcode Fuzzy Hash: c385fdda561922424afa88111352050d55bff8198f006e60d9eab1b2380f9eea
                      • Instruction Fuzzy Hash: 3C51F93220025166FB2AAFA795953FE62A0FB4C7D4F648A19FF258B5F5DB34CC95C200
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ColorModeObjectRectSelectText$BeginFillInflateMessagePaintParentSend
                      • String ID: $$mmm
                      • API String ID: 2831168041-2121012940
                      • Opcode ID: 72d469fca32c71b60844e5d59afe3351aceb042936d5bcc8a753e7db9d08057f
                      • Instruction ID: 7fe27c53826e8c32a37ab61d6107eaea9ca91f83995ddb382b2c8246072d0a9b
                      • Opcode Fuzzy Hash: 72d469fca32c71b60844e5d59afe3351aceb042936d5bcc8a753e7db9d08057f
                      • Instruction Fuzzy Hash: 79518632701A848AFB16EB66D8547DC2371FB88B98F504626AF1D57AE6EF34C904C380
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$DesktopEnableEnabledMessageSendmemcpy_s
                      • String ID:
                      • API String ID: 687856882-0
                      • Opcode ID: 407e3bd7411df60969c77e0d4df8c062b81db0894d575f2fa61cbd5ad2df9603
                      • Instruction ID: 1deffcfa45060d2ed8a2fb5ed5ea67dbbe9d805e8df10cc716a45811eb84c706
                      • Opcode Fuzzy Hash: 407e3bd7411df60969c77e0d4df8c062b81db0894d575f2fa61cbd5ad2df9603
                      • Instruction Fuzzy Hash: C7418131204B4182FB56AB37E8443E962A5EB8DBE4F684A25FB5D877F6DF39C4418600
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: InflateRect
                      • String ID: iii$
                      • API String ID: 2073123975-462628325
                      • Opcode ID: e6a65b328b4297dd1fa313fe0faf6926d6c8c121229e0223a7a974990ece3ab2
                      • Instruction ID: 23586ee7b147a5ad77279d14e30852efa9c8897553a692452351f66f50c682cd
                      • Opcode Fuzzy Hash: e6a65b328b4297dd1fa313fe0faf6926d6c8c121229e0223a7a974990ece3ab2
                      • Instruction Fuzzy Hash: 63517B327406508BE66B9F279508BE9B7A0F74DFE4F148226AF15137F4CB789991CB80
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object$Stock$CapsCreateDeviceFontIndirect
                      • String ID: (
                      • API String ID: 545130359-3887548279
                      • Opcode ID: 381b608d399f0e728f1578eb51373fa737216e857f982d182afa165211322f59
                      • Instruction ID: 7c0ed80226887d3c107d1852a561ab8058160844c448844168c92e2ccdc0620b
                      • Opcode Fuzzy Hash: 381b608d399f0e728f1578eb51373fa737216e857f982d182afa165211322f59
                      • Instruction Fuzzy Hash: FD518A72711A408AE711CB76D8907ED77B0F7487A8F004229EF6D57AA9DF38C959C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$DesktopFolderRedrawWindow
                      • String ID:
                      • API String ID: 898402146-0
                      • Opcode ID: 22cfd3b5b5461815e261cb8675fab1147b95fad7b9ef202f6527c71f09af5211
                      • Instruction ID: 3cfd3ab144fde8e63288132ba337194efbe9448585c784cfc3c690c915258562
                      • Opcode Fuzzy Hash: 22cfd3b5b5461815e261cb8675fab1147b95fad7b9ef202f6527c71f09af5211
                      • Instruction Fuzzy Hash: AF410877310A84DAEB11DF62E850BDD23A1F788B88F448122EF0D4BAA9DF39D519C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CloseCreate$AddressHandleModuleOpenProc
                      • String ID: software
                      • API String ID: 550756860-2010147023
                      • Opcode ID: 02b5cdb7630e6b99934bc5a97975d27bebf3f5b7bdca450e1e8ee1913dd1310a
                      • Instruction ID: a25326a6d54623c165420ffe713b4ef1aaa010eb6678dd9381aa8ce6c5dc8c24
                      • Opcode Fuzzy Hash: 02b5cdb7630e6b99934bc5a97975d27bebf3f5b7bdca450e1e8ee1913dd1310a
                      • Instruction Fuzzy Hash: B4414C72205B9086EB61CF22F480B9A77A5F7887D8F541225FF9E03B28DB38C194C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: free$AtomDeleteGlobal
                      • String ID:
                      • API String ID: 622211665-0
                      • Opcode ID: 894070186622278d75e318e4722547bf3177b7de71bd4debdd02e496e6a18b6d
                      • Instruction ID: 478349a539330067a1c58cf9d622b13cf14b173c1b7e0e97b05abd1c32af397c
                      • Opcode Fuzzy Hash: 894070186622278d75e318e4722547bf3177b7de71bd4debdd02e496e6a18b6d
                      • Instruction Fuzzy Hash: 1C412276201A8481EF56EF66E4903ED3361EB88F94F188125DB4E4B7B6CF75C885C354
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: GroupItemMessageNextParentSend$LongWindow
                      • String ID:
                      • API String ID: 789784501-0
                      • Opcode ID: 8582a9e8c68535ae5689a13deddee10dfeb1b8500e04885741e04c08a507a410
                      • Instruction ID: 8ba5053038a69ad3a0f26696d5d2509ec5da14da9d84095ae13117c42d425b8c
                      • Opcode Fuzzy Hash: 8582a9e8c68535ae5689a13deddee10dfeb1b8500e04885741e04c08a507a410
                      • Instruction Fuzzy Hash: 4531BC76301A9082EE96DB27A8007EA63A0F78CFC4F084136EF0A47779EE39C541C710
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Destroy$AcceleratorMessageParentSendTable
                      • String ID:
                      • API String ID: 1621014984-0
                      • Opcode ID: 3d1e2453f8fb919a8eb5c8ee091e1ef8d8cd01b67544898a93ab98355ef10e8d
                      • Instruction ID: 1678bbe4c0783537c992edb69aa07a2a9be7e7c81465e90e3204924b5f4dd457
                      • Opcode Fuzzy Hash: 3d1e2453f8fb919a8eb5c8ee091e1ef8d8cd01b67544898a93ab98355ef10e8d
                      • Instruction Fuzzy Hash: D9416C72211A8482EB52DF22E4887ED73A0F799FE4F580625EB5A07AB5CF3DC545C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$Window$ChildFocusVisible
                      • String ID:
                      • API String ID: 1252167185-0
                      • Opcode ID: ac870da89e0a5bdd787c58c4825d08df9d2b584a85ac4b87637969c80270c8f0
                      • Instruction ID: 423eba69d09e0463866ebce1385ce1f5160a81c73c4f1ca925afd4f1e62cbf87
                      • Opcode Fuzzy Hash: ac870da89e0a5bdd787c58c4825d08df9d2b584a85ac4b87637969c80270c8f0
                      • Instruction Fuzzy Hash: 29310875311A818AEA56CF17E8547EA67A0FB8CFD4F144026EF1A8B7B0EF75C8528740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ObjectRect$ClientScreenSelectWindow$AddressCompatibleCreateDeleteHandleIconicModuleOffsetProc
                      • String ID: DWMAPI$DwmSetIconicLivePreviewBitmap
                      • API String ID: 361077708-239049650
                      • Opcode ID: 54bf5b911c1f502e29f13bb6c4df9d8110602cf2921d02a0d26f6ad59d0bcd86
                      • Instruction ID: ae858d3bfdad252cc618ee3bf8e184814468d25aebab3c45041fd95248d03955
                      • Opcode Fuzzy Hash: 54bf5b911c1f502e29f13bb6c4df9d8110602cf2921d02a0d26f6ad59d0bcd86
                      • Instruction Fuzzy Hash: D2311772B11A409AEB02DBB2D4587ED37B0B788B89F444416DF091BB69DF38C659C750
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend
                      • String ID: @
                      • API String ID: 3850602802-2766056989
                      • Opcode ID: 0fb2c85cbcae3d65d34872790468d2d9457f021c7d900df039d8a1acb32a84d3
                      • Instruction ID: b810609f0af43424fc1f21ae270ac4e0f52046748329727b7b8c72bfe3cb8867
                      • Opcode Fuzzy Hash: 0fb2c85cbcae3d65d34872790468d2d9457f021c7d900df039d8a1acb32a84d3
                      • Instruction Fuzzy Hash: 58218D71710680C2FB669F52D850BD92261FB8CBC8F548525FB494BBA4DF3DC9558701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$ActiveFocus$MessageSend
                      • String ID:
                      • API String ID: 1556911595-0
                      • Opcode ID: 6a25c30fab17df08bed1aad8e680586b7063283a4c9126e0da50c2f8ee4232ac
                      • Instruction ID: e7bc5f50c9e6db1aec0ffe25f866a764fad589b4f70aa19142cc326793d21bf0
                      • Opcode Fuzzy Hash: 6a25c30fab17df08bed1aad8e680586b7063283a4c9126e0da50c2f8ee4232ac
                      • Instruction Fuzzy Hash: 94214F31310A95C5FB6A9B27A8447E966A0EB8DFC4F180121FF854BBB5DF7AC5418B40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: State$AsyncKeyboard$CharLayoutUnicodeUpperVirtual
                      • String ID:
                      • API String ID: 298839909-0
                      • Opcode ID: 9e51aef277dbfef9e7e354ff82e1daf09ed74842b3a38cc40be82d987d0bf7c0
                      • Instruction ID: 3581ec4034648379c9c7298072d70713c97294545cbb00cfaad1efd8cdfd1347
                      • Opcode Fuzzy Hash: 9e51aef277dbfef9e7e354ff82e1daf09ed74842b3a38cc40be82d987d0bf7c0
                      • Instruction Fuzzy Hash: A8318231604A8483FB22DF22E8947EE73A1F78CB84F544025EB4A47AB9DF79C845CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: __doserrno_errno
                      • String ID:
                      • API String ID: 921712934-0
                      • Opcode ID: 1eb9c7ce253c479792460a28c5571d756ac43cbb374699178b94623942866f05
                      • Instruction ID: 59ef7774d25f3de8cc01ecc46976be2544ff0edcb936f99d18ce5ca634dc87eb
                      • Opcode Fuzzy Hash: 1eb9c7ce253c479792460a28c5571d756ac43cbb374699178b94623942866f05
                      • Instruction Fuzzy Hash: 1421AE3221064046F7176F279D517EE6661A798FA1F094604BB2A0B2F3CAB9C84187A1
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Thread$CreateErrorLastResume_errno_getptd_invalid_parameter_noinfofree
                      • String ID:
                      • API String ID: 3220277038-0
                      • Opcode ID: eb1ca011717da64d4cc5adc57dd058ed9d9cdce191acf08cd26f740bf4d1d608
                      • Instruction ID: 402d8050fe05c79427aef14c70f22155923b980e15e81157fa0e632e295fa50f
                      • Opcode Fuzzy Hash: eb1ca011717da64d4cc5adc57dd058ed9d9cdce191acf08cd26f740bf4d1d608
                      • Instruction Fuzzy Hash: AE217F31211B4085EB16ABA7A9413ED72A0FB4CFA0F5C0A25EF6D1B7E2DF79D4108300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • GetCapture.USER32 ref: 0000000140020B95
                      • SendMessageW.USER32(?,?,?,0000000140020CAB,?,?,00000000,0000000140004873), ref: 0000000140020BAB
                      • GetFocus.USER32(?,?,?,0000000140020CAB,?,?,00000000,0000000140004873), ref: 0000000140020BCA
                      • SendMessageW.USER32(?,?,?,0000000140020CAB,?,?,00000000,0000000140004873), ref: 0000000140020BE0
                        • Part of subcall function 0000000140010AF8: GetParent.USER32 ref: 0000000140010B21
                      • GetLastActivePopup.USER32 ref: 0000000140020C12
                      • SendMessageW.USER32(?,?,?,0000000140020CAB,?,?,00000000,0000000140004873), ref: 0000000140020C28
                        • Part of subcall function 0000000140010AF8: GetWindowLongW.USER32 ref: 0000000140010B45
                        • Part of subcall function 0000000140010AF8: GetParent.USER32 ref: 0000000140010B54
                      • SendMessageW.USER32(?,?,?,0000000140020CAB,?,?,00000000,0000000140004873), ref: 0000000140020C55
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$Parent$ActiveCaptureFocusLastLongPopupWindow
                      • String ID:
                      • API String ID: 3194460488-0
                      • Opcode ID: a46d3eb06fc8195e76aaa728e1fe26556ae3be6685ba75dea8eca6521639fa88
                      • Instruction ID: bbe7acb3120ccfe6340864dfc3874b2b9d5eaba264fd1e0a092328274d287cc0
                      • Opcode Fuzzy Hash: a46d3eb06fc8195e76aaa728e1fe26556ae3be6685ba75dea8eca6521639fa88
                      • Instruction Fuzzy Hash: 5021307431179182FE6B5F27A965BE91550AB9DFC8F545029BF0A0BBA2EE3DD8404700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressProc$HandleModule
                      • String ID: KERNEL32.DLL$RegisterApplicationRecoveryCallback$RegisterApplicationRestart
                      • API String ID: 667068680-723216104
                      • Opcode ID: 39558250b50fac553253a50e1706a050ce4c12adb14490ccbf6994dc6ca481de
                      • Instruction ID: 8b2ae9ab864da245f68b61cb4192c8723ecfe7ab86e32f6effd79102f21bfa29
                      • Opcode Fuzzy Hash: 39558250b50fac553253a50e1706a050ce4c12adb14490ccbf6994dc6ca481de
                      • Instruction Fuzzy Hash: 29114875311B5981EA56DB13B9407D9B7A8FB9CFC0F480421EF4907B68EF38D4418700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressProc$HandleModule
                      • String ID: ApplicationRecoveryFinished$ApplicationRecoveryInProgress$KERNEL32.DLL
                      • API String ID: 667068680-4287352451
                      • Opcode ID: f07f91f5c75b53938aa2e259b8796ad6f4e499a9683c2803fa245b8498c749f2
                      • Instruction ID: 8e6781c3c5aa00a8e712289ea843b764013ec287799bdf629ef2fd69c1f707b2
                      • Opcode Fuzzy Hash: f07f91f5c75b53938aa2e259b8796ad6f4e499a9683c2803fa245b8498c749f2
                      • Instruction Fuzzy Hash: 40112531626B4486EB16DB66F8443E963A4FB8CFC0F485525EB4A077A8EF38C8458700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d1f882662bbc87573f42169722f9dcd365b795edc70ece9972cd5a0830b4ab9d
                      • Instruction ID: 3b75f64a65f3190b5fb09f8ca3f77381687e61bff500c0583f16005caa997489
                      • Opcode Fuzzy Hash: d1f882662bbc87573f42169722f9dcd365b795edc70ece9972cd5a0830b4ab9d
                      • Instruction Fuzzy Hash: D2126C72710A458AEB11CF7AE4507AE77B0F788B98F044216EF9A63BA4DF38D545CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$OffsetParentWindow
                      • String ID:
                      • API String ID: 4200989157-0
                      • Opcode ID: 5b8b0da08413322dd3e872e64bd6f9f2c9d2271d2fa3929be0054d1e2e6e2cec
                      • Instruction ID: ee74cad985495dbaa2460279c72bfbb33375283925ed8ec4f87ddf357d4e688d
                      • Opcode Fuzzy Hash: 5b8b0da08413322dd3e872e64bd6f9f2c9d2271d2fa3929be0054d1e2e6e2cec
                      • Instruction Fuzzy Hash: CAA12476B106908AEB59CFA6E484BDD7BB1B348BD8F504019EF4A63B58DF39C945CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Capture$Parent$Empty$ClientFocusInvertRelease
                      • String ID:
                      • API String ID: 54144319-0
                      • Opcode ID: 0a4838b14d800187ae70e9b1aa87c118c652ae1f24b583ca52fd0cfd4e84f1c6
                      • Instruction ID: 7ba75bd49235687bef3a1d4c06c779d10a46af9ccc6281c6f2064b68dd781327
                      • Opcode Fuzzy Hash: 0a4838b14d800187ae70e9b1aa87c118c652ae1f24b583ca52fd0cfd4e84f1c6
                      • Instruction Fuzzy Hash: 0B918F32311A9086EB55DB2BD998BEE2365F788FD5F054226EF1A477A9CF38C481C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$Rect$Client
                      • String ID:
                      • API String ID: 4194289498-0
                      • Opcode ID: aba7eb0dc827aabf785ad2fabe13fcc7c2a6e47fc7faeb0d4f73faae7d938c70
                      • Instruction ID: d327b169ea3f2a58e2ddf26cc493e9f14a16d85ac64677327efb857612f97239
                      • Opcode Fuzzy Hash: aba7eb0dc827aabf785ad2fabe13fcc7c2a6e47fc7faeb0d4f73faae7d938c70
                      • Instruction Fuzzy Hash: CA510636611A40CAE761CF3AD8947ED37A1F788F88F595126EF0A47768DE35C842C750
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _errnofree$AllocateBoundaryCreateDeleteDescriptorErrorHeapLastSection_callnewhmallocmemcpy_s
                      • String ID:
                      • API String ID: 1573770261-0
                      • Opcode ID: 65476563a6ca0706b5eef82f7335e03d93b5cf7fbc6c80436aadac606f138df8
                      • Instruction ID: b93af07f18dff378f1c01a2c50557e3c0f8380557273f9c9531050505c1e28fb
                      • Opcode Fuzzy Hash: 65476563a6ca0706b5eef82f7335e03d93b5cf7fbc6c80436aadac606f138df8
                      • Instruction Fuzzy Hash: 6A418C7220074086EB77AA27A5503DEA3A1FB8CFC4F588425AF464BBB6EB78D5548700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • GetWindowRect.USER32 ref: 00000001400A221D
                        • Part of subcall function 00000001400A1958: GetParent.USER32 ref: 00000001400A1971
                        • Part of subcall function 00000001400A1958: GetSystemMenu.USER32(?,?,?,?,?,?,?,00000001400A2249), ref: 00000001400A1997
                        • Part of subcall function 00000001400A1958: SetMenuDefaultItem.USER32(?,?,?,?,?,?,?,00000001400A2249), ref: 00000001400A19C6
                        • Part of subcall function 00000001400A1958: GetParent.USER32 ref: 00000001400A19D0
                        • Part of subcall function 00000001400A1958: IsZoomed.USER32 ref: 00000001400A19E2
                        • Part of subcall function 00000001400A1958: EnableMenuItem.USER32 ref: 00000001400A19FB
                        • Part of subcall function 00000001400A1958: EnableMenuItem.USER32 ref: 00000001400A1A10
                        • Part of subcall function 00000001400A1958: EnableMenuItem.USER32 ref: 00000001400A1A25
                        • Part of subcall function 00000001400A1958: EnableMenuItem.USER32 ref: 00000001400A1A6D
                        • Part of subcall function 00000001400A1958: GetParent.USER32 ref: 00000001400A1A77
                        • Part of subcall function 00000001400A1958: DeleteMenu.USER32(?,?,?,?,?,?,?,00000001400A2249), ref: 00000001400A1A9F
                        • Part of subcall function 00000001400A1958: DeleteMenu.USER32(?,?,?,?,?,?,?,00000001400A2249), ref: 00000001400A1AB1
                        • Part of subcall function 00000001400A1958: GetParent.USER32 ref: 00000001400A1ABB
                        • Part of subcall function 00000001400A1958: DeleteMenu.USER32(?,?,?,?,?,?,?,00000001400A2249), ref: 00000001400A1AE3
                        • Part of subcall function 00000001400A1958: GetParent.USER32 ref: 00000001400A1AF7
                      • KillTimer.USER32(?,?,?,?,?,?,?,?,?,?,?,0000000140090C73), ref: 00000001400A225A
                      • GetKeyState.USER32 ref: 00000001400A22A5
                      • GetKeyState.USER32 ref: 00000001400A22BC
                      • GetFocus.USER32 ref: 00000001400A231A
                      • SetTimer.USER32 ref: 00000001400A2368
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Menu$ItemParent$Enable$Delete$StateTimer$DefaultFocusKillRectSystemWindowZoomed
                      • String ID:
                      • API String ID: 3553910245-0
                      • Opcode ID: 23392c6d9903c2ef316028558e09c9d1bb555c03d7486aa53c3ff59838b8600f
                      • Instruction ID: f9c82055d4b6edda534df0256347a7eb3f2ebe9eaee57e148cdf3536daf8ea96
                      • Opcode Fuzzy Hash: 23392c6d9903c2ef316028558e09c9d1bb555c03d7486aa53c3ff59838b8600f
                      • Instruction Fuzzy Hash: A841EC7271464092FA669B2BD5443E96290F7AEBD5F100235FF0A0BBB1DE78C9D18B01
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Profile$CopyCursorDragDropEmptyInflate
                      • String ID:
                      • API String ID: 1351899944-0
                      • Opcode ID: 37fd7b38f54034a48517b91bb17490bd5671b884b27fac27099ea77e5c7446a5
                      • Instruction ID: 5c6829040a9a78c6d59697faa5f4ec490ddbbd6243c19538f29407c8959d5c1c
                      • Opcode Fuzzy Hash: 37fd7b38f54034a48517b91bb17490bd5671b884b27fac27099ea77e5c7446a5
                      • Instruction Fuzzy Hash: 6F416E3221464486EA62DB17E8547EEB3A0FB8DBD4F485126AF8A077B8DF38C446C711
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientCursorRect$MessageScreenSend
                      • String ID:
                      • API String ID: 277080217-0
                      • Opcode ID: 16a9636e03e8c131787ed867fe90dee4a01aa4a55560df4787a53117d6aaaf30
                      • Instruction ID: 72980ad98c27474a6f8902822a989ba80de790b6070d894d3e6afbf6bc8c6fcd
                      • Opcode Fuzzy Hash: 16a9636e03e8c131787ed867fe90dee4a01aa4a55560df4787a53117d6aaaf30
                      • Instruction Fuzzy Hash: FC419E73215A4082FFA2CB52E4587EE6760FB89BD9F040121EB4A0BAB5CF7DC646C710
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Destroy$AcceleratorParentTable
                      • String ID:
                      • API String ID: 3451810566-0
                      • Opcode ID: fb4f4d52c2347312c4092d6f6c8d420f7be4ef6f573927edf16ef144af17acb5
                      • Instruction ID: 3bec0293c10d9481d71401684771e9345197f67de0dab630550ae5c0cb4c910b
                      • Opcode Fuzzy Hash: fb4f4d52c2347312c4092d6f6c8d420f7be4ef6f573927edf16ef144af17acb5
                      • Instruction Fuzzy Hash: 4E418036214B4482EB62DB23E5447AA63B0F78DFE4F140225EF5A477A5CF38C955C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Destroy$AcceleratorParentTable
                      • String ID:
                      • API String ID: 3451810566-0
                      • Opcode ID: c0225f60cd744e04aed0c3e4d9106d4d8afd96d913450a9fd5f71e97700cefa4
                      • Instruction ID: 3fd6f6492ec0856c3b7acf50747c7ae7c8c3c1f4b8ded5780b2d396a0a3f2cd1
                      • Opcode Fuzzy Hash: c0225f60cd744e04aed0c3e4d9106d4d8afd96d913450a9fd5f71e97700cefa4
                      • Instruction Fuzzy Hash: 36415A72214E8486EB66DB23E5487AA63A0F798FE4F140221EF5A077F9DF78C945C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCMT ref: 00000001400C641A
                      • Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCMT ref: 00000001400C6434
                      • Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCMT ref: 00000001400C6441
                      • Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCMT ref: 00000001400C644E
                      • Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCMT ref: 00000001400C645B
                      • Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCMT ref: 00000001400C6468
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ContextExternal$BaseBase::~Concurrency::details::
                      • String ID:
                      • API String ID: 1690591649-0
                      • Opcode ID: 7265d63791e1b19f3edd3c9d1adee766319ce7340f2380735de2642b944ba268
                      • Instruction ID: 99b9961afc6abedf13ca1eb9bb9c24108acf04c5c7f3430aff4debae6fe9a9a9
                      • Opcode Fuzzy Hash: 7265d63791e1b19f3edd3c9d1adee766319ce7340f2380735de2642b944ba268
                      • Instruction Fuzzy Hash: C8316F72306A8092EB15AF3AC8453DD23A0F789F94F588235EB5D872B9DF78C985C750
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MetricsRectSystem$ClientInvalidateMessageSendUpdateWindow
                      • String ID:
                      • API String ID: 896808119-0
                      • Opcode ID: 4b7c59d9901c761af2ac5a43911552561a69eaef4112513fb012891d44a7edfa
                      • Instruction ID: c511e9b6e8c6c489efcd9010a4903a2f87ddf7203634dd44ddbceb59dcad66b6
                      • Opcode Fuzzy Hash: 4b7c59d9901c761af2ac5a43911552561a69eaef4112513fb012891d44a7edfa
                      • Instruction Fuzzy Hash: F8312336210A40CBE721CF76E88879D37B0F78CB99F510225EB1A47AA9CF79D485CB50
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Close$Delete$PrivateProfileStringValueWrite
                      • String ID:
                      • API String ID: 1330817964-0
                      • Opcode ID: 44a2976962da78c0a832bfa79483ee09d33acffca5ec7cfea44c7209f9fe1fd7
                      • Instruction ID: 537dda439eeb5f03a88ee389a3fa5b97e8a10f44cf71c122bd5539dad39cbbdb
                      • Opcode Fuzzy Hash: 44a2976962da78c0a832bfa79483ee09d33acffca5ec7cfea44c7209f9fe1fd7
                      • Instruction Fuzzy Hash: 2E21B075701B9485EA56DB63B554BEAA7E2BB8DFC0F084025AF0927BB4DF39C1048700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
                      • String ID:
                      • API String ID: 3283625137-0
                      • Opcode ID: df38925a348bd2b5cef53c7e3f1fbe881b7ec94f13802559ab9e3553c712a9d1
                      • Instruction ID: 27d33cde8538c7ee84a0898a2f8eaee99f0f82add6669be813608c9ac33fc7ef
                      • Opcode Fuzzy Hash: df38925a348bd2b5cef53c7e3f1fbe881b7ec94f13802559ab9e3553c712a9d1
                      • Instruction Fuzzy Hash: 6921653120478086EB56AF77A5517DAB390F788FD4F484225AF69077E6DF39D4508740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CaptureInvalidateMessageParentRectSendTimerUpdateWindow
                      • String ID:
                      • API String ID: 3683363781-0
                      • Opcode ID: d9501b2148e72c87e423a6e35ef3d6862d53828d44fdc670acd20950e9183e12
                      • Instruction ID: 3046aed26e39f53a59711a381aa38105ec6eeca35f6517791089655d39714984
                      • Opcode Fuzzy Hash: d9501b2148e72c87e423a6e35ef3d6862d53828d44fdc670acd20950e9183e12
                      • Instruction Fuzzy Hash: 0021387671168082EB5ADF27E6897E96360F78CFC4F144025EB4A07B61DF3AC4928B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Capture$RectRelease$Empty$Invert
                      • String ID:
                      • API String ID: 2029503137-0
                      • Opcode ID: ff33a0fc6bc42e9343731b95b399f4fb06cbdf0036a646a452c1775f035566df
                      • Instruction ID: 4fd3ce45d47c7a89952fec79054d08e5fba55cac33941b69a2c0c8a5eb27e548
                      • Opcode Fuzzy Hash: ff33a0fc6bc42e9343731b95b399f4fb06cbdf0036a646a452c1775f035566df
                      • Instruction Fuzzy Hash: 37118E32301940D7EB1AAB63CA483ED2361FB0CBD6F080120DB15076B5CF78D8A5C701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • GetLastError.KERNEL32(?,?,00000018,0000000140156059,?,?,?,?,000000014015574A,?,?,00000018,0000000140002DA0), ref: 000000014015AA62
                      • FlsGetValue.KERNEL32(?,?,00000018,0000000140156059,?,?,?,?,000000014015574A,?,?,00000018,0000000140002DA0), ref: 000000014015AA70
                      • SetLastError.KERNEL32(?,?,00000018,0000000140156059,?,?,?,?,000000014015574A,?,?,00000018,0000000140002DA0), ref: 000000014015AAC8
                        • Part of subcall function 000000014015C604: Sleep.KERNEL32(?,?,?,000000014015AA8B,?,?,00000018,0000000140156059,?,?,?,?,000000014015574A,?,?,00000018), ref: 000000014015C649
                      • FlsSetValue.KERNEL32(?,?,00000018,0000000140156059,?,?,?,?,000000014015574A,?,?,00000018,0000000140002DA0), ref: 000000014015AA9C
                      • free.LIBCMT ref: 000000014015AABF
                      • GetCurrentThreadId.KERNEL32 ref: 000000014015AAB0
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLastValue_lock$CurrentSleepThreadfree
                      • String ID:
                      • API String ID: 3106088686-0
                      • Opcode ID: 2775d209e400eda27944a5320f1e50e4524e97c8205c13b984e5cebb49d40e08
                      • Instruction ID: 87e360d6d360ea8625b257b7bc954d49d371b694b0d3af9534913383273a74c4
                      • Opcode Fuzzy Hash: 2775d209e400eda27944a5320f1e50e4524e97c8205c13b984e5cebb49d40e08
                      • Instruction Fuzzy Hash: 4601FF3520274586FB57AB67E4987A862A1AB8CF60F5C8624DB260B3F5EF3DC844C611
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l
                      • String ID: %sMFCToolBar-%d$%sMFCToolBar-%d%x$Buttons
                      • API String ID: 2941638530-3567013142
                      • Opcode ID: 60df1e717ca1852404fc0458e854bafac5689d32999c9bf971f11ed7f65f6499
                      • Instruction ID: 94210f64a3bafa48af3efe05c0b832c55d37723ab81a59c1ff32b4044bcef12e
                      • Opcode Fuzzy Hash: 60df1e717ca1852404fc0458e854bafac5689d32999c9bf971f11ed7f65f6499
                      • Instruction Fuzzy Hash: FFA1AB72301A8486EB65DB2AD4447DE73A0FB89FE4F458522EF5A43BA5DF78C884C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: lstrlen$wcsnlen
                      • String ID: 1$1
                      • API String ID: 1105126865-2061416233
                      • Opcode ID: 9f7edd7af31941af7152ecf0617050a6c2be9eeba637065dd9fb6bb1979617a6
                      • Instruction ID: ec3b765fa6ef037e4a084725f3645a9e6470001c3bed8436cf81308337638a61
                      • Opcode Fuzzy Hash: 9f7edd7af31941af7152ecf0617050a6c2be9eeba637065dd9fb6bb1979617a6
                      • Instruction Fuzzy Hash: C081C23660064185EB2BAF27D4543EE63A0FB8CBD4F998126FF5A477F5DB38C8918205
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ExtensionFileFindModuleNamePath
                      • String ID: .CHM$.HLP$.INI
                      • API String ID: 2295281026-4017452060
                      • Opcode ID: cb30247b98fc6cacfd23767955c3d5127c5ea0d53f394c22075bb63f4cbdb987
                      • Instruction ID: 970e52f3ef37784c53ccdd130a0d1f32ed96442d747adb6cc8767238dbf29b0f
                      • Opcode Fuzzy Hash: cb30247b98fc6cacfd23767955c3d5127c5ea0d53f394c22075bb63f4cbdb987
                      • Instruction Fuzzy Hash: AD718D31200B8144FB67AB6794953EA23A4FB4DBC4F980925FB5D8B6BADF36C584C341
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MediumRelease$Clipboard
                      • String ID: '
                      • API String ID: 3486090133-1997036262
                      • Opcode ID: c79cbf419181aded3865ae1dec49eaf20464169994fe7c78aede3ea28a72f049
                      • Instruction ID: 2eb17a94d7490a5da16115170a460fac995d29f05b84946502303243f7f789b7
                      • Opcode Fuzzy Hash: c79cbf419181aded3865ae1dec49eaf20464169994fe7c78aede3ea28a72f049
                      • Instruction Fuzzy Hash: 82714B32209B9082FA669B97E4503D9A3A0F79DFD0F144125AB8E47BB9DF39D945C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CloseEnumOpenQueryValue
                      • String ID: Software\
                      • API String ID: 3984146545-964853688
                      • Opcode ID: f434e4ebecd1ef56b2dd0a849bddd222edba9841bfc0388fdd3aa0e70b54f24f
                      • Instruction ID: 59378e19bcca218128962f92db72a5a70c4c89ae09c35a725c6ac5426f299419
                      • Opcode Fuzzy Hash: f434e4ebecd1ef56b2dd0a849bddd222edba9841bfc0388fdd3aa0e70b54f24f
                      • Instruction Fuzzy Hash: EA616072714A8582EB51DB2AE844BDA63A1F788BE4F445221FB6E877E4DF7CC445C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: EmptyRect
                      • String ID: False$True
                      • API String ID: 2270935405-1895882422
                      • Opcode ID: baa85324531feb0efb808be9a73876913023b6bb826a068f50957ed89deb279f
                      • Instruction ID: 362087e7eab3487d89eff12def403dfb92a637b5663eeaa862d68862669e8145
                      • Opcode Fuzzy Hash: baa85324531feb0efb808be9a73876913023b6bb826a068f50957ed89deb279f
                      • Instruction Fuzzy Hash: B271F332101F8087D7699F35F8803DAB7A8FB48741F404219DBAAA37A1DF39E5A5DB04
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CloseEnumOpen
                      • String ID: Software\Classes\
                      • API String ID: 1332880857-1121929649
                      • Opcode ID: d96067ca82a7f3b35bd6257b5fed1c2b30b382d3654c4956bced0b3c1b823701
                      • Instruction ID: 7905b7a3487c1e7f12c83fbb8e667edcec03195a8bbe037c5e130833f5e3dccb
                      • Opcode Fuzzy Hash: d96067ca82a7f3b35bd6257b5fed1c2b30b382d3654c4956bced0b3c1b823701
                      • Instruction Fuzzy Hash: E25184B2715A8582EB51DB2AF48479AA361F788BE0F544221FB6D43BF9DF38C845C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l
                      • String ID: %sBasePane-%d$%sBasePane-%d%x$IsVisible
                      • API String ID: 2941638530-4027084908
                      • Opcode ID: 2ed565ade2f46cb39522dffa4e0502c5fc546e76b23099195cfc6f0aad69244c
                      • Instruction ID: e7c625e714261373b8aed93786a7afb54f3d68130d6fb02f256b88cdadd0df69
                      • Opcode Fuzzy Hash: 2ed565ade2f46cb39522dffa4e0502c5fc546e76b23099195cfc6f0aad69244c
                      • Instruction Fuzzy Hash: 25518C72B01B4986EB01DB2AD84079D23A0FB89FE4F448212EF6E577A5DF78C885C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l
                      • String ID: %sBasePane-%d$%sBasePane-%d%x$IsVisible
                      • API String ID: 2941638530-4027084908
                      • Opcode ID: 25c32583c9f9b44c86600d6976cd34d0a9ce1383b3c3b1e2b039fb694ef9b463
                      • Instruction ID: ed73349a996ac099a558a85a018c6cd75da4006dd15cb1016f8460c14037f662
                      • Opcode Fuzzy Hash: 25c32583c9f9b44c86600d6976cd34d0a9ce1383b3c3b1e2b039fb694ef9b463
                      • Instruction Fuzzy Hash: 96416772701B0482EB059B6AD8807EC23A0B799FE4F448326EF2A577E5CF34C885C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: LongWindow$MessageSend
                      • String ID: @
                      • API String ID: 2178440468-2766056989
                      • Opcode ID: 4b1b86d55bee0aa894044c17785638ec56d257edd1ec0c5beac24e11a43c3172
                      • Instruction ID: fff19269396c9da64ab6f1f7bfd1c25fd71bf25ff61b50a5d5ff5cdc5c9f2f5d
                      • Opcode Fuzzy Hash: 4b1b86d55bee0aa894044c17785638ec56d257edd1ec0c5beac24e11a43c3172
                      • Instruction Fuzzy Hash: 5E417972301B8082EBA6EB62E59039D73A1FB88FC4F584215EB4D07BA5CF39C851C341
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressProc$Activate
                      • String ID: CloseTouchInputHandle$GetTouchInputInfo$user32.dll
                      • API String ID: 2388279185-1853737257
                      • Opcode ID: 7bcd6e18c89b5a0ee52cb894df96b975e5f4c5824d84d89d9cb44b8ab43d2f0b
                      • Instruction ID: 674a03b7be5368f96fd3ebee21f70eb9bf67c97f23cb6d0d31ffe2903fc52381
                      • Opcode Fuzzy Hash: 7bcd6e18c89b5a0ee52cb894df96b975e5f4c5824d84d89d9cb44b8ab43d2f0b
                      • Instruction Fuzzy Hash: 57416CB1240B8081FA56DB23A8587E573A4B79DFE0F080225FB6A577F0DF79CA018340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientCursorMessageScreenSendfree
                      • String ID: @
                      • API String ID: 1997331945-2766056989
                      • Opcode ID: d0f0373757ebc08ed2594c5f6ff89a870126492b9b8f82b2dc71e29569976964
                      • Instruction ID: 964366eea80c9c1a97caf0b4c4563dbffc6a0e0ab6583960b4dceba896ba3d29
                      • Opcode Fuzzy Hash: d0f0373757ebc08ed2594c5f6ff89a870126492b9b8f82b2dc71e29569976964
                      • Instruction Fuzzy Hash: 15418D32614A8082EB62DB13E4947D973A0FB9DBA8F454225EB5E47BB5DF3CC845CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressCreateHandleModuleProc
                      • String ID: Advapi32.dll$RegCreateKeyTransactedW
                      • API String ID: 1964897782-2994018265
                      • Opcode ID: d0bef51350e641903b93814aada60ecbd3475644e0119cde3df2de94724071ea
                      • Instruction ID: e5eb9f8341e7a536efec92736299cbac4e97a217b2f66a6f081ef37457842352
                      • Opcode Fuzzy Hash: d0bef51350e641903b93814aada60ecbd3475644e0119cde3df2de94724071ea
                      • Instruction Fuzzy Hash: AA31E376608B8486EB61CF56F48479AB3A5F78CBC4F144126EB9D83B69DF38C485CB01
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object$RectSelect$AddressCompatibleCreateDeleteHandleModuleOffsetProcWindow
                      • String ID: DWMAPI$DwmSetIconicThumbnail
                      • API String ID: 1122452334-3761315311
                      • Opcode ID: f1b225342cebea5cf88aee0c5757d368529468c2e0a817117dd3fe00f5bab149
                      • Instruction ID: 9cde2bd7b4dfa7e7a816b07cbae715f79fbff8247e62265668201bb9920dcb61
                      • Opcode Fuzzy Hash: f1b225342cebea5cf88aee0c5757d368529468c2e0a817117dd3fe00f5bab149
                      • Instruction Fuzzy Hash: BD117636312B8881EA629B17A4447AA77A0EB8CFC0F485026EF4D03B64DF38D445C710
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleModuleOpenProc
                      • String ID: Advapi32.dll$RegOpenKeyTransactedW
                      • API String ID: 1337834000-3913318428
                      • Opcode ID: 823e50985d2f76f5f683f0cbe0175e25aa830953b4a2309a9750c6d2d76f2305
                      • Instruction ID: c343ee73282695ab5fa9b71c693c41e4e2ac164b5d9e47239ab62c00bc3414ed
                      • Opcode Fuzzy Hash: 823e50985d2f76f5f683f0cbe0175e25aa830953b4a2309a9750c6d2d76f2305
                      • Instruction Fuzzy Hash: A6112372208B54C2EA22CB66F84479AB3A1F788FD4F184225EB8917B78CF38C4418B01
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend
                      • String ID: E$F$G
                      • API String ID: 3850602802-2285628837
                      • Opcode ID: 256c5c326a83ae47373976dd64b2d1c66c7c5fcaabf4a31c02ec2c52d56b052d
                      • Instruction ID: e953018724f22510b84fb92976922089004aa49496d65506a20dc8b619a2d175
                      • Opcode Fuzzy Hash: 256c5c326a83ae47373976dd64b2d1c66c7c5fcaabf4a31c02ec2c52d56b052d
                      • Instruction Fuzzy Hash: A411A57171069086FB769B13E9847E92691F78CBC4F284836FF4807BE5CB3AC4818740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: Advapi32.dll$RegDeleteKeyExW
                      • API String ID: 1646373207-2191092095
                      • Opcode ID: a36724835cba7b98259a117d0ed0601340068d9adb1bb18ce3b283179fd6372e
                      • Instruction ID: 0ebe8cc1a51a708eb955468f1629185fccb3446b7ed8e0dd2fcb0b123509c151
                      • Opcode Fuzzy Hash: a36724835cba7b98259a117d0ed0601340068d9adb1bb18ce3b283179fd6372e
                      • Instruction Fuzzy Hash: AC113C7161668482FF168B27F44CBA923A0AB8DFD4F044525EF1A0B7B4DB7DC5858311
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressAttributesFileHandleModuleProc
                      • String ID: GetFileAttributesTransactedW$kernel32.dll
                      • API String ID: 3217448241-1378992308
                      • Opcode ID: 6d622c70eca75d6dcfac8f8d13177a171f88a5508061f5548fd5a45da1248b1f
                      • Instruction ID: df182c38b14bbacb1a256de50fdde66d1938c2cabd4163e7d9effaf662feb20d
                      • Opcode Fuzzy Hash: 6d622c70eca75d6dcfac8f8d13177a171f88a5508061f5548fd5a45da1248b1f
                      • Instruction Fuzzy Hash: CF015A3170AA84C5EB56AB53E84439A63A0EB9EFC1F1C8425EF4A43774CF78C982C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressDeleteHandleModuleProc
                      • String ID: Advapi32.dll$RegDeleteKeyTransactedW
                      • API String ID: 588496660-2168864297
                      • Opcode ID: 9d0775ef054e7ce680c8af6e2d36b4ef15af5a098728733e74f9baa5b0acc9ff
                      • Instruction ID: 8f87bf3c9f7aca5af542ca3de47ff3605ba25311c13374d79ca07895ba93b482
                      • Opcode Fuzzy Hash: 9d0775ef054e7ce680c8af6e2d36b4ef15af5a098728733e74f9baa5b0acc9ff
                      • Instruction Fuzzy Hash: BD010C7121568082FB66CB26F854BAAA3A2E74DFC8F188425EF8917BB4CF3DC551C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ActivateClearVariantlstrlenmemcpy_s
                      • String ID:
                      • API String ID: 347659384-0
                      • Opcode ID: 092183c94ebb1259ca5ae34fdd76da0adac0ad05cf225a17b6f1ca6c905e07ab
                      • Instruction ID: a96c5a90bf376fbd2677b7d16ce25f0d922fe7330391fdaa04a0b3ee6d2c5118
                      • Opcode Fuzzy Hash: 092183c94ebb1259ca5ae34fdd76da0adac0ad05cf225a17b6f1ca6c905e07ab
                      • Instruction Fuzzy Hash: DAD18D37100A808AEB7A9F2698843ED23A4FB0D7E8F544616FB6A47BF5DB34C655C341
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$DeferRect$BeginEqual
                      • String ID:
                      • API String ID: 2366145349-0
                      • Opcode ID: 74e592846ae260f0249528be17d933f1d1e4f93d768b25a60fca9e94d6c0bfdb
                      • Instruction ID: bf4f56e661ff66141fb1396a5e04d513a323ac483283cea008c48bbc1b42234d
                      • Opcode Fuzzy Hash: 74e592846ae260f0249528be17d933f1d1e4f93d768b25a60fca9e94d6c0bfdb
                      • Instruction Fuzzy Hash: 7D715A33B24B508AFB19CBA2E9487ED73B0B708BD9F544415EF1927AA9CB78C545C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CloseQueryValue$PrivateProfileStringwcsnlen
                      • String ID:
                      • API String ID: 206682969-0
                      • Opcode ID: 6b696c37e2fb120164b9bc334ccf9aae7cee82e0b0df4c01cc1a19b5745bb7d5
                      • Instruction ID: bbc0bec00f37091b64fee0470bf907058df80d0b3238fc1b2943cfcab8d6f8d8
                      • Opcode Fuzzy Hash: 6b696c37e2fb120164b9bc334ccf9aae7cee82e0b0df4c01cc1a19b5745bb7d5
                      • Instruction Fuzzy Hash: 97519CB2301A4086EB56DB36A8547EE73A1FB88BD8F405125BB5E47BA9DF38C4858700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AllocString
                      • String ID:
                      • API String ID: 2525500382-0
                      • Opcode ID: 6dfe34a89cbd03ff48b417104f494aec6a3e6bccfc87c6811beee0c28ddb72ee
                      • Instruction ID: 8f46e67792505aed1edaddb4bc7853d40e01bbde44993b1225f58af3f5c2d111
                      • Opcode Fuzzy Hash: 6dfe34a89cbd03ff48b417104f494aec6a3e6bccfc87c6811beee0c28ddb72ee
                      • Instruction Fuzzy Hash: 50613BB7210F4487E751DB26D88039D77A0F788BA4F444221EB6987BE5DF78C995C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientCursorScreen$Rect
                      • String ID:
                      • API String ID: 1082406499-0
                      • Opcode ID: 5965edc7fa4b71b5f716fe4e88a97c8f3a948f4a30608b07317e41d5fbd023e1
                      • Instruction ID: 542b7dea1a2545df3d4aabf95b32061a3f5ee91a2d5bc97c0be10e1ed695524f
                      • Opcode Fuzzy Hash: 5965edc7fa4b71b5f716fe4e88a97c8f3a948f4a30608b07317e41d5fbd023e1
                      • Instruction Fuzzy Hash: C8514532B10A408AEB16DB27E9847ED73A0F748BD9F494026EF0907AA9DF78C4958744
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Variant$ClearFreeString$Copy
                      • String ID:
                      • API String ID: 3003973349-0
                      • Opcode ID: ac0bf1f4f88068e8b2086974bf3895e5c8fec2b3f34a3e3dbcab522a3d3bc2b1
                      • Instruction ID: d2f97f4e73016f8f1d2d308f7a1fd20e9f6974eafdf23f7920d4d28bc01e14a7
                      • Opcode Fuzzy Hash: ac0bf1f4f88068e8b2086974bf3895e5c8fec2b3f34a3e3dbcab522a3d3bc2b1
                      • Instruction Fuzzy Hash: EF518B32341A848AEB62CF66D4547ED3374FB48B98F51522AEF1E57AA8DF34C949C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: FolderMessageSend$AllocDesktopGlobalLocationSpecial
                      • String ID:
                      • API String ID: 1965538066-0
                      • Opcode ID: be09044015a97ba25ed2217a471ee53e8bf0eee9bfa5f60d33d11f7803452fb5
                      • Instruction ID: b01502da8970acb43c3404f7df9b181b1c04f80f540aef1098e4154845a576c5
                      • Opcode Fuzzy Hash: be09044015a97ba25ed2217a471ee53e8bf0eee9bfa5f60d33d11f7803452fb5
                      • Instruction Fuzzy Hash: 66517776701A408AE7058F7AD8547ED23B1FB88BA8F048329EF2947BE9DF39C1558340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Read$AddressLibraryLoadProcmallocrealloc
                      • String ID:
                      • API String ID: 127335102-0
                      • Opcode ID: cea8f199c73d725b9cacc388d34ad4c689cbf5dc99f4c2acf68b09e3d2ab8b8f
                      • Instruction ID: 757a31ffa88d09af759843ea5e4baaba9dee7cc2598208a66f41e3edcc531505
                      • Opcode Fuzzy Hash: cea8f199c73d725b9cacc388d34ad4c689cbf5dc99f4c2acf68b09e3d2ab8b8f
                      • Instruction Fuzzy Hash: D3316872704B048BEB26CB1AE8947AA77A4FB89BC4F494425EF5D073A5DF38C852C705
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CursorLoad$Create
                      • String ID:
                      • API String ID: 1516763891-0
                      • Opcode ID: 0716edf7723a662f6e95fae5aa3720ab706e560126b25971971d2598b9a8084f
                      • Instruction ID: 50e3199cb46c78ee1206782df08e9e66485910907aafa93db230cb75d5890883
                      • Opcode Fuzzy Hash: 0716edf7723a662f6e95fae5aa3720ab706e560126b25971971d2598b9a8084f
                      • Instruction Fuzzy Hash: 11416B70640A4581FE17BB73A85D7ED2290AB8EBD5F480035AB0A4B3F2DEBDC4848355
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$MessageSend$RectRedrawVisible
                      • String ID:
                      • API String ID: 1695962874-0
                      • Opcode ID: 8bd51dd6573c540f3aa7aa2d87f4430b7ab59fa242f2e5d4fc187b8633519e77
                      • Instruction ID: 8cb16b94ad4a088e157b199f1df5fe3ec693aa0bfee399c9cefdcb17342b36c4
                      • Opcode Fuzzy Hash: 8bd51dd6573c540f3aa7aa2d87f4430b7ab59fa242f2e5d4fc187b8633519e77
                      • Instruction Fuzzy Hash: 184148367206948AEB11CF6AD454BAE77A5F78DFC8F144126EF4957B68CF39C4028B80
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ObjectSelect$AlphaBlendCompatibleCreateDelete
                      • String ID:
                      • API String ID: 3820319696-0
                      • Opcode ID: 910c69f0a213be2e03e38b52362cceb47004988f00e9327a780fa460beda4051
                      • Instruction ID: 8d18bc7fbb51ba4bedcb027bb40fd6baad443849b9caed77020fb38a94a73ee7
                      • Opcode Fuzzy Hash: 910c69f0a213be2e03e38b52362cceb47004988f00e9327a780fa460beda4051
                      • Instruction Fuzzy Hash: CD419276205790CAD7A1CF26E484B4E77A9F74DB94F254125DB8983B29CB35C881CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Global$CriticalSection$AllocCreateEnterLeaveLockStream
                      • String ID:
                      • API String ID: 983187867-0
                      • Opcode ID: 8cc6a40d446647607aa0aa75cffb6bc96b8b97dcff5a60276eed7c17ddbf868c
                      • Instruction ID: 35c033032e564f5df16d8460d75279d209ae87ad3b2ce7aa08347285675972bb
                      • Opcode Fuzzy Hash: 8cc6a40d446647607aa0aa75cffb6bc96b8b97dcff5a60276eed7c17ddbf868c
                      • Instruction Fuzzy Hash: DF316D72620B0086EB16EB57E848B9923B0F78CBE1F654129EB29073F6DF79C944C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Clip$Client$ExcludeIntersectOffsetScreenWindow$MessageReleaseSend
                      • String ID:
                      • API String ID: 890540625-0
                      • Opcode ID: 41a36498bb93cbd0b5eeaa83f6ed179d9daaea727ccc3eb4977c627f6aeed1c2
                      • Instruction ID: 952c7f3cfbbaffb1520779df4faa4fb0abd9889f5f4c820f07c3ae24c112d0b8
                      • Opcode Fuzzy Hash: 41a36498bb93cbd0b5eeaa83f6ed179d9daaea727ccc3eb4977c627f6aeed1c2
                      • Instruction Fuzzy Hash: D531F272B20A658AEB00DBA2D8557DC3331F349BAEF404512DE1E6BAA9DF74C509C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CaptureMenu$DeleteRect$ReleaseWindow$CreateEmptyEnableItemRoundSystem
                      • String ID:
                      • API String ID: 2896308491-0
                      • Opcode ID: a797873e470b573e0b9e3f6a77403e1bd92ba72d16aaba9a0817fbab62a825bb
                      • Instruction ID: 44394a5a453c3096879ee702a1531938104353aff692c68d37a1148caa6407c9
                      • Opcode Fuzzy Hash: a797873e470b573e0b9e3f6a77403e1bd92ba72d16aaba9a0817fbab62a825bb
                      • Instruction Fuzzy Hash: 34315E35710A8086EBA29F23D4947E963A0EBCDFC4F598035EF0A4BB65DF38C8418740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend
                      • String ID:
                      • API String ID: 3850602802-0
                      • Opcode ID: fe1bd1a6cb5663938efb86590901f3154fda278a4323ce29691b24869b633573
                      • Instruction ID: 8acddad1c99585f482b59ace4a5df4bd41f7633c84fa748c7f915a1e0d2e5fe9
                      • Opcode Fuzzy Hash: fe1bd1a6cb5663938efb86590901f3154fda278a4323ce29691b24869b633573
                      • Instruction Fuzzy Hash: 993178B6250B81CAEB21CF62D800BDC3720F788B8DF504912FF1917A58CB38C946C791
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$Window$Desktop
                      • String ID:
                      • API String ID: 697626773-0
                      • Opcode ID: aba7e8f5ab57dd410674b4a4a2ad36cb4c8460fbf2d2ea4b15367790a030d02d
                      • Instruction ID: 660098950733858a21d644e0dd3fe009b804d7de18244d4a7cebd35cbbad9e08
                      • Opcode Fuzzy Hash: aba7e8f5ab57dd410674b4a4a2ad36cb4c8460fbf2d2ea4b15367790a030d02d
                      • Instruction Fuzzy Hash: 0121A43031068082FB1A9B63E9157EE5292BB8DFC4F254425FF5A4BFA5EF39C4408301
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateCreateDeactivateWindow
                      • String ID:
                      • API String ID: 3635781065-0
                      • Opcode ID: a28a4dc8c3d6dc384266da3b34db15ba54cc034e5152bc5c2f3917e4dd5d78a4
                      • Instruction ID: 478b844f315a397512abf4a4c8b708f1b2d67725f5f43492ec7aacb4c3a2c283
                      • Opcode Fuzzy Hash: a28a4dc8c3d6dc384266da3b34db15ba54cc034e5152bc5c2f3917e4dd5d78a4
                      • Instruction Fuzzy Hash: 7A31D776214B8486E7619B56F88479AB7E5F78CBC0F14402AEF8D83B68DF78C445CB01
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Window
                      • String ID:
                      • API String ID: 924285169-0
                      • Opcode ID: 983b8341effc2ccf395289f78b04a4cda4b0446c41e85f63695d1f902a406dbd
                      • Instruction ID: 3c2f25826f0250aaf2588a12e6cd9c1915c8ed8849c88a10f0a0a34914a9fd20
                      • Opcode Fuzzy Hash: 983b8341effc2ccf395289f78b04a4cda4b0446c41e85f63695d1f902a406dbd
                      • Instruction Fuzzy Hash: E6310972712A118AFB02DB62D8587ED33B0B748BAAF084425DB49576B9DF78C5498740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$EmptyInvert$Client
                      • String ID:
                      • API String ID: 2328105127-0
                      • Opcode ID: f0a20f0060fa47b0f96d2c103e4a05ff0566470ba0808994430d002666eaecb8
                      • Instruction ID: 7009a2335fc3ea584c1694582a69ce49f88553e251422c10ac46b918df58cfee
                      • Opcode Fuzzy Hash: f0a20f0060fa47b0f96d2c103e4a05ff0566470ba0808994430d002666eaecb8
                      • Instruction Fuzzy Hash: CD318932B10A40DAE714DB72D8847ED73B1F348B9AF404521EF1DA3A69DB38D965CB80
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ObjectSelect$ColorCompatibleCreateDeleteTable
                      • String ID:
                      • API String ID: 3899591553-0
                      • Opcode ID: 7e5eb09d72c8d99abfe0ed8a658b08655f927f601875ce6dea40a1fd15ceace1
                      • Instruction ID: 2b5e7e0b8b3a58b88e39a0a35d7d85f31e7454ab01538693bb3598d2a2bc0c2b
                      • Opcode Fuzzy Hash: 7e5eb09d72c8d99abfe0ed8a658b08655f927f601875ce6dea40a1fd15ceace1
                      • Instruction Fuzzy Hash: D2214932210B508AEB5A8F66D4947693374FB88FD8F545026EF4A57B79CF35C891C780
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$DesktopLongShow
                      • String ID:
                      • API String ID: 1948769292-0
                      • Opcode ID: bc688d230990344f864994a62ff24e94a7ea155533921de2fb092f1c79a52e15
                      • Instruction ID: 2c2d1ed236d53e5ad9b1738a1e059dc33088e959ce69eb5275fa39aa202ee49a
                      • Opcode Fuzzy Hash: bc688d230990344f864994a62ff24e94a7ea155533921de2fb092f1c79a52e15
                      • Instruction Fuzzy Hash: B6219631200B8447FB6ACB17AC143AA6392EB59FD0F285924EB5B073A6DF38C8418300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Resource$FindFreeLoadLockSizeof
                      • String ID:
                      • API String ID: 4159136517-0
                      • Opcode ID: 01ac08799de8958622d7e2121a36748273dfc775b8f317e4b3a970e4c0d6433d
                      • Instruction ID: b612e2aada4b2bc02d3d723650263713334d063394674a956c6fa84c840c2b10
                      • Opcode Fuzzy Hash: 01ac08799de8958622d7e2121a36748273dfc775b8f317e4b3a970e4c0d6433d
                      • Instruction Fuzzy Hash: 63118E31315B8085EA46DFA76988BAA62E0BB4EFD0F484435EF1A07B65EF38C5418340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CapsDevice$ModeViewportWindow
                      • String ID:
                      • API String ID: 2598972148-0
                      • Opcode ID: c1e2679814eadaa2858d014a204ed85270a1feb217b462a3a9371724a8d840fe
                      • Instruction ID: eac657af63fd1e49242d006de7a43dc9ce252686840de1d3378b159406823696
                      • Opcode Fuzzy Hash: c1e2679814eadaa2858d014a204ed85270a1feb217b462a3a9371724a8d840fe
                      • Instruction Fuzzy Hash: 7B11F939710A4083EB159F26E4987AEA361EB8DFD0F288426DB5A47768CF39CC468740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CapsDevice$ModeViewportWindow
                      • String ID:
                      • API String ID: 2598972148-0
                      • Opcode ID: ba34fd6ca90d10131df7445e7b8588eec108d5e815461460d56463e755e871a9
                      • Instruction ID: f0227bdef8c72b284ed9f56c4fc5a1e85bd2be9cf670ca2afa0b269fc0505d7e
                      • Opcode Fuzzy Hash: ba34fd6ca90d10131df7445e7b8588eec108d5e815461460d56463e755e871a9
                      • Instruction Fuzzy Hash: 5C110A75700A4083EB159F22E8987AA7361F78DFD0F248425DF9A477A8CF39CC868740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ParentRect$ClientFillPointsWindow
                      • String ID:
                      • API String ID: 3058756167-0
                      • Opcode ID: a5b49e3d3974a3cf206968cec4ff9d40599d862dd49fdff779b7d35563bd9ad2
                      • Instruction ID: 1ac46ebd2c3a5f2809956df8e127f456660349fe7a12ea54e1367eaa38f4b29a
                      • Opcode Fuzzy Hash: a5b49e3d3974a3cf206968cec4ff9d40599d862dd49fdff779b7d35563bd9ad2
                      • Instruction Fuzzy Hash: 1C114776214A8082EA159B66F4987AAB361FB8CFD9F004126EF8E43B64CF38C545C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Parent$MessagePost
                      • String ID:
                      • API String ID: 2076725448-0
                      • Opcode ID: cdcc6fdc22c9e9894efecfdc7685069448ddcafab9f5c644d1a2f82fc61c839a
                      • Instruction ID: 2daf5f725b8f655aad1858a13454cd2bfdf331331cfad70c2d74af51f78d3c25
                      • Opcode Fuzzy Hash: cdcc6fdc22c9e9894efecfdc7685069448ddcafab9f5c644d1a2f82fc61c839a
                      • Instruction Fuzzy Hash: CB11163571168082EE0ADB63B5643AA6360A78DFC8F044135FF0E5BB6ADE39C5458340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Cursor$CaptureLoad
                      • String ID:
                      • API String ID: 1460996051-0
                      • Opcode ID: e9376b93a6e77239ec606478ffd40dca929dcd85cc0831bacdfcc524a41bb4d6
                      • Instruction ID: 1569ba4b989bc218a4b82c433eda5ec8bd3729d221f4cbb124fd9be12d7c5717
                      • Opcode Fuzzy Hash: e9376b93a6e77239ec606478ffd40dca929dcd85cc0831bacdfcc524a41bb4d6
                      • Instruction Fuzzy Hash: A821F931601A8581EF56DF67E8587E92360EB99FC9F084035EB0E4B3B5DE3AC4899315
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Free$Heap$LibraryProcessVirtualfree
                      • String ID:
                      • API String ID: 831075735-0
                      • Opcode ID: 6ac62a77bbb3a6cce43fadfa29995754d2ab38eb1740dbf7484921f4acface18
                      • Instruction ID: 65c5f84c1fb216ab80269f78d6d1410d0a1d3d94f351e0c7876cbae6784f0df7
                      • Opcode Fuzzy Hash: 6ac62a77bbb3a6cce43fadfa29995754d2ab38eb1740dbf7484921f4acface18
                      • Instruction Fuzzy Hash: 2A118972610A4082EB55DF67E49479973A0FB88F98F144625DB6A476F8CF34C492C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateClassDeactivateRegister
                      • String ID:
                      • API String ID: 402371002-0
                      • Opcode ID: 0ebbfd8d1a880ab05df4d7138127200cd154379e2aa22e1735fe77e0dc3a7ef1
                      • Instruction ID: 72293ebe108c3628bf3388a874c06c1adbaa260d71b6d0a2239dddbf418427db
                      • Opcode Fuzzy Hash: 0ebbfd8d1a880ab05df4d7138127200cd154379e2aa22e1735fe77e0dc3a7ef1
                      • Instruction Fuzzy Hash: E6116976214B9482E7219B26E4447AAB3A4FB8CFD1F595115EF8A477B4DF38C441C704
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateClassDeactivateInfo
                      • String ID:
                      • API String ID: 1248994726-0
                      • Opcode ID: a27387b88edce1088706fc2d9686ddbc99585a1f6c33a59d807a35db240a0caa
                      • Instruction ID: ac00bceb0d6c0a97b3f64c9f20a6a176df96c101060f1198d6ed8a68e365859a
                      • Opcode Fuzzy Hash: a27387b88edce1088706fc2d9686ddbc99585a1f6c33a59d807a35db240a0caa
                      • Instruction Fuzzy Hash: 82018C72204B8182E7119BA7E8847AAA7A5FB8CFD1F184135EF4987778CFB8C4498701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateClassDeactivateInfo
                      • String ID:
                      • API String ID: 1248994726-0
                      • Opcode ID: c9a960cdc5b98aa9eff6260b36fce243f72d58575e37609e00be588f57a6565e
                      • Instruction ID: dbdd3642dc0c8267ba176efcc86c547241461e2a602915aaf9a3105d5e2e6f0c
                      • Opcode Fuzzy Hash: c9a960cdc5b98aa9eff6260b36fce243f72d58575e37609e00be588f57a6565e
                      • Instruction Fuzzy Hash: ED018C72204B8182EB119FA3B8847AAA7A5FB8CFD1F184135EF4987778CF78C4498701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientScreen$LongMessageParentSendWindow
                      • String ID:
                      • API String ID: 4240056119-0
                      • Opcode ID: 1b98adafd262570aa75c733690eb0c5a3c3c9109bc8c20341a784f62ab307b32
                      • Instruction ID: 24506f09f76eecc60dd5ebeb33aca21dd082c0dfa10eb9e48d63405520a44274
                      • Opcode Fuzzy Hash: 1b98adafd262570aa75c733690eb0c5a3c3c9109bc8c20341a784f62ab307b32
                      • Instruction Fuzzy Hash: FD01B12132478082EB528F1BA6853BAA261FB88BD1F405125FE5643BB9DF7CC9498700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Global$LockUnlock$Create
                      • String ID:
                      • API String ID: 2536725124-0
                      • Opcode ID: ec7e6ef878dd4056c21a6e244599bd42cc85fea0260fd2882768301ccfc14b17
                      • Instruction ID: 83728f8bf46cd744069c8bb9420f488bd5b648063b95676f24377cb305c4e38d
                      • Opcode Fuzzy Hash: ec7e6ef878dd4056c21a6e244599bd42cc85fea0260fd2882768301ccfc14b17
                      • Instruction Fuzzy Hash: F7012D3160565582EE669B17B5847B9A2E0EB5CFD4F485531EF8747B74EF3CC4418300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                      • String ID:
                      • API String ID: 1445889803-0
                      • Opcode ID: 1176603d26c24d338d3f1b1ea677ddd4f27970e01bc1473c738b397ff2e20285
                      • Instruction ID: 778f561e591a7860c1dc15af84e9c352da9d81d0a7793e41745227f6fb31dc80
                      • Opcode Fuzzy Hash: 1176603d26c24d338d3f1b1ea677ddd4f27970e01bc1473c738b397ff2e20285
                      • Instruction Fuzzy Hash: 45015B31255A4482E7A28F22E8847996360F74DF91F446521EF6E47BB4DB7CCD968340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Message$CapturePost$PeekRelease
                      • String ID:
                      • API String ID: 1125932295-0
                      • Opcode ID: f1c124cc8df63aa99e76f69a26a1133db932f6764dc4429472c5ce5f3ae79f16
                      • Instruction ID: 4b8cf2c2bd4e145d56cb21f6d00d4caf4e30d50bcca516ac4fafe5134ccf9b71
                      • Opcode Fuzzy Hash: f1c124cc8df63aa99e76f69a26a1133db932f6764dc4429472c5ce5f3ae79f16
                      • Instruction Fuzzy Hash: 21018F32721541C3FB269F62E858BAA2660FB98F8DF505424EF1907EA4EF3AC0458B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: RectRedrawWindow$CaptureRelease
                      • String ID:
                      • API String ID: 1080614547-0
                      • Opcode ID: 849b7dac542a7e402fbdac539d57e3460c254b35b4b7ed504405d3cc39793a74
                      • Instruction ID: ce71c991147fc1e75852e9e858246db124b6d96f635e8c8489a030707b10b9e5
                      • Opcode Fuzzy Hash: 849b7dac542a7e402fbdac539d57e3460c254b35b4b7ed504405d3cc39793a74
                      • Instruction Fuzzy Hash: 8B012C76A10690C2FB658B73E458FE82260E758F89F084439DF02572B4DF7DC4468710
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CriticalSection$Enter$DeleteGdiplusLeaveObjectShutdown
                      • String ID:
                      • API String ID: 1513102227-0
                      • Opcode ID: 53eca0f12ffb6928e98bebb7d66d37f06a38996b1d967d9d94a287263610c603
                      • Instruction ID: 38739bd9191d0e7b069c82094bf5e22cc2fffe90788eeb1a2ccaa3b6f6ad3b14
                      • Opcode Fuzzy Hash: 53eca0f12ffb6928e98bebb7d66d37f06a38996b1d967d9d94a287263610c603
                      • Instruction Fuzzy Hash: 38112A72512A008AEB56DB16E888BE93370F71CF2AF200A04D71A061F0CBB9C65BC784
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: __doserrno_errno
                      • String ID:
                      • API String ID: 921712934-0
                      • Opcode ID: c9ca9f45759c5bceeabb886aa84ffaf01f5978fb8e526404072b7bcb145e9ed3
                      • Instruction ID: 190db75476c07390cadd81c9caeded92d33b9d2f887192085e3914a1a17b536c
                      • Opcode Fuzzy Hash: c9ca9f45759c5bceeabb886aa84ffaf01f5978fb8e526404072b7bcb145e9ed3
                      • Instruction Fuzzy Hash: 64018CB2210A0484EA072B27C8913ED6264AB98F71F594700E73A0B3F6C77EC4418252
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Color$ModeObjectSelect$Text
                      • String ID: $
                      • API String ID: 1460252324-3993045852
                      • Opcode ID: c6df075b774ab249cca92e9bb85c0783471b0d7e61a82234b945257f027579c1
                      • Instruction ID: 64fe14ab558e0b5ca25990a53cb860f949174546d1486a9e3fb9d51d15b5eef6
                      • Opcode Fuzzy Hash: c6df075b774ab249cca92e9bb85c0783471b0d7e61a82234b945257f027579c1
                      • Instruction Fuzzy Hash: 45B15636B14A548BE715CF7AD488BAD37A1F74CBC8F004615EF0A63BA8CB35D9458B40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_lfree
                      • String ID: %sDockingManager-%d$DockingPaneAndPaneDividers
                      • API String ID: 52267941-4068244756
                      • Opcode ID: b88ce1b3326419acbae801e108e8c930e8cd2a0e7f347a62d409c828f28afbdc
                      • Instruction ID: 4f91799b38b84f01a5539dc4346fb95b19903c4f87e5c1e6a9ed9f232dbc51fd
                      • Opcode Fuzzy Hash: b88ce1b3326419acbae801e108e8c930e8cd2a0e7f347a62d409c828f28afbdc
                      • Instruction Fuzzy Hash: B391AF72201E8082EA169B27D9147DA6362FB89BE0F544612FF6E47BF5DF38C945C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$ModeOffset$Inflate
                      • String ID: %
                      • API String ID: 3790764107-2567322570
                      • Opcode ID: 2932ba7e76a200afd0ec4e26e241c8e1f48179c1a5f04efade05387944efaee5
                      • Instruction ID: 6a1ee29f5fa1a134d0dd6141be3c6f6601ea2db9118195a04d6f65d7720ef8b2
                      • Opcode Fuzzy Hash: 2932ba7e76a200afd0ec4e26e241c8e1f48179c1a5f04efade05387944efaee5
                      • Instruction Fuzzy Hash: 50516936B10A548AEB51DF7A8904BEE37A5F74CBC8F088226EF09577A8DB38D5558700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CreateRect$BrushFillIndirectSolid_cwprintf_s_l
                      • String ID: %d%%
                      • API String ID: 1336714879-1518462796
                      • Opcode ID: 56cffcb080434deabbfd52f9122d224ee7f36bb9e0efdefab55d503b9d4ce7ac
                      • Instruction ID: 5335cbe596ff4f7d349c31f461f002360ff958c3e2549a8367f95b1842414535
                      • Opcode Fuzzy Hash: 56cffcb080434deabbfd52f9122d224ee7f36bb9e0efdefab55d503b9d4ce7ac
                      • Instruction Fuzzy Hash: 95616A36B00A408AEB11DF66D4547DD3371FB89BA8F504126EF5967BA8DF34C94AC780
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ByteCharCtrlMultiWideWindow
                      • String ID: P
                      • API String ID: 102189203-3110715001
                      • Opcode ID: 77d987076da70331d391eab5be5e3ad91acf6ccb9d18d4fdbff4d2d25a1cfb72
                      • Instruction ID: a8e74071d9d680fc8e14df082a422697dbdb314c9ed12116fcb9b9624c90c57c
                      • Opcode Fuzzy Hash: 77d987076da70331d391eab5be5e3ad91acf6ccb9d18d4fdbff4d2d25a1cfb72
                      • Instruction Fuzzy Hash: 2051D132200A4282FB259B2AD854BDE63A1FB89BB4F644715FB7D876F5DF78C9448700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_lfree
                      • String ID: %sMDIClientArea-%d$MDITabsState
                      • API String ID: 52267941-353449602
                      • Opcode ID: 217c3805714e2e18d4027b94fe7daded5eee36936aa22062f9d3276600f27826
                      • Instruction ID: 7d6c5f14f7ad958176fd4f0ca6ecf05048cd2c7bc0fbeff9492ba679eac4a5bd
                      • Opcode Fuzzy Hash: 217c3805714e2e18d4027b94fe7daded5eee36936aa22062f9d3276600f27826
                      • Instruction Fuzzy Hash: 11518172315A8182EB11DB2AE4507DE6360FBC9BE4F545222AB6D437F9DF38C845CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: swprintf$_vswprintf_s_lmemcpy_swcsnlen
                      • String ID: - $:%d
                      • API String ID: 621187927-2359489159
                      • Opcode ID: 96329ec361aab98062c44452823d8a933b620af602a0e409f329cd425a714d04
                      • Instruction ID: 83abbdcdc462e836fe36ed5d3af5bfa9cd03ae28798c0d1c4c90c7cfe130cce4
                      • Opcode Fuzzy Hash: 96329ec361aab98062c44452823d8a933b620af602a0e409f329cd425a714d04
                      • Instruction Fuzzy Hash: E4518D32710E4195EB26EB27D8517DC2365BB48BC8F944126AF1E5BAB6EF34C905C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l
                      • String ID: %sMFCToolBar-%d$%sMFCToolBar-%d%x
                      • API String ID: 2941638530-3776508225
                      • Opcode ID: ff4e562cb4188f61d32fbdd9f6e162dce1232b2653e763be2e0818ecafac7409
                      • Instruction ID: e2d0918110da44b0f2d174ca505ef89fbc2945dbffee0ec91369aeef1d6830df
                      • Opcode Fuzzy Hash: ff4e562cb4188f61d32fbdd9f6e162dce1232b2653e763be2e0818ecafac7409
                      • Instruction Fuzzy Hash: B7415772B00E4086EB159B6AD8457EC23A1FB89BF4F498726EF29577E5DF38C9418340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CriticalSection$AddressEnterFreeInitializeLeaveLibraryProc
                      • String ID: HtmlHelpW$hhctrl.ocx
                      • API String ID: 3379933665-3773518134
                      • Opcode ID: 5cb877f24cf8501eb751f3a952355459559ae3c23f98bff53abaa6a23cde43eb
                      • Instruction ID: 92e78cfa6aeaaa24a56306f4f419b489d392b40eebede4d56af339010b33d7a7
                      • Opcode Fuzzy Hash: 5cb877f24cf8501eb751f3a952355459559ae3c23f98bff53abaa6a23cde43eb
                      • Instruction Fuzzy Hash: 24214432211B5581EB06EB63E8543A963A4FB9CFC4F484429EB890B7A6DF79C950C380
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: DWMAPI$DwmInvalidateIconicBitmaps
                      • API String ID: 1646373207-1098356003
                      • Opcode ID: 9e6473f88fbdd94caa62b6264b4351e1c74cea8a0133e843eeac7d8446ddd219
                      • Instruction ID: cd5cda062f0e62b02c58d3249c2046ce7c324a71c68bf5713755053b59dc382f
                      • Opcode Fuzzy Hash: 9e6473f88fbdd94caa62b6264b4351e1c74cea8a0133e843eeac7d8446ddd219
                      • Instruction Fuzzy Hash: 5A215072214B4586EB638B27E4443AA63E4F78CB99F489125EB8D476A8DF7CD584CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: COMCTL32.DLL$TaskDialogIndirect
                      • API String ID: 1646373207-244319309
                      • Opcode ID: 27b8847f9e1eb3e254eb3ae13684cad62beac6ff6810a3e443e30c8775e2ab03
                      • Instruction ID: 300f7e3524f0e8f06c0f5f0ba034ac73b1b42df1cfcd8708db9ca738c3b70e27
                      • Opcode Fuzzy Hash: 27b8847f9e1eb3e254eb3ae13684cad62beac6ff6810a3e443e30c8775e2ab03
                      • Instruction Fuzzy Hash: EF218E31301B8091EB26DB62E5443DDA3A0FB4CB94F848621EB6D07AF5EF38D659C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$EqualRectRedraw
                      • String ID: X
                      • API String ID: 960909151-3081909835
                      • Opcode ID: 270480f439d970108798cd0524f9fe08fee5bc362280411ff1c2489bb1dbebc9
                      • Instruction ID: d6e7f257a25a52d3299581ab6f0c66514018eab14de9e07d83fce2b90aac711b
                      • Opcode Fuzzy Hash: 270480f439d970108798cd0524f9fe08fee5bc362280411ff1c2489bb1dbebc9
                      • Instruction Fuzzy Hash: 54116A72A1068087E715DF2AE588B9D7761F798B88F58C124EF890B668DF79D498CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$DrawEdgeFillInflate
                      • String ID: iii
                      • API String ID: 785442924-940974255
                      • Opcode ID: e4a354a6cab911887cd82985d571a0d524c850a87b9a27dddb39948ecb03a11d
                      • Instruction ID: 56c3f05d69f54d20d863cbea8cd92cb8d886884e5003955f5841e96fd4424179
                      • Opcode Fuzzy Hash: e4a354a6cab911887cd82985d571a0d524c850a87b9a27dddb39948ecb03a11d
                      • Instruction Fuzzy Hash: 6D111C32614A8587D7218F26E594799B360F78CBA8F449219EB8907A69CF3CD945CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: InflateRect
                      • String ID: iii$
                      • API String ID: 2073123975-462628325
                      • Opcode ID: b93c8a059e8944fd940ed4d70d6b2701b15e4a27f72f678c994700c37965c78b
                      • Instruction ID: 016e9aa797f82d2af14bb96562134dfd5f112c54f661e7a59eb3ba14fb045451
                      • Opcode Fuzzy Hash: b93c8a059e8944fd940ed4d70d6b2701b15e4a27f72f678c994700c37965c78b
                      • Instruction Fuzzy Hash: C201E93435024086E6269B37AA8CFA8B661E75DBE9F048224AE1507BF4CB7D9D818B40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000000,000000014000F5E8,?,?,00000400,0000000140013249), ref: 000000014000E20E
                      • LoadLibraryW.KERNEL32(?,?,?,?,?,?,00000000,000000014000F5E8,?,?,00000400,0000000140013249), ref: 000000014000E221
                      • GetProcAddress.KERNEL32(?,?,?,?,?,?,00000000,000000014000F5E8,?,?,00000400,0000000140013249), ref: 000000014000E23F
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: InitCommonControls
                      • API String ID: 310444273-2489084829
                      • Opcode ID: 5cef7fb9cfc0bb480069c907a9343fc8e485c2c089f55d1743d8792fb9a5ad09
                      • Instruction ID: ad52bee693ae37bbf217a8531540adda567d403cb3c4e63fe35b62e88a6b1b85
                      • Opcode Fuzzy Hash: 5cef7fb9cfc0bb480069c907a9343fc8e485c2c089f55d1743d8792fb9a5ad09
                      • Instruction Fuzzy Hash: 5801E472202B85C5EF568F26E88435863A4E79CF88F188125DB9C47368DF38C9A6C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • GetModuleHandleW.KERNEL32(?,?,00080000,000000014000F5A3,?,?,00000400,0000000140013249), ref: 000000014000E2E6
                      • LoadLibraryW.KERNEL32(?,?,00080000,000000014000F5A3,?,?,00000400,0000000140013249), ref: 000000014000E2F9
                      • GetProcAddress.KERNEL32(?,?,00080000,000000014000F5A3,?,?,00000400,0000000140013249), ref: 000000014000E317
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: InitCommonControlsEx
                      • API String ID: 310444273-2357626986
                      • Opcode ID: 2464da50fd0023d02a947890cf1cce47538acf8dbfe7abe7b1c62496a6e77bab
                      • Instruction ID: 3c48cbfd99e516a3953ed209923cf3604f4260014e4656f7eabe1c313022ab6d
                      • Opcode Fuzzy Hash: 2464da50fd0023d02a947890cf1cce47538acf8dbfe7abe7b1c62496a6e77bab
                      • Instruction Fuzzy Hash: C201F672202F84C5EB568F26E89835873A4E79CF98F289125DB4C47378DF38C9A6C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: ImageList_GetIcon
                      • API String ID: 310444273-3623868649
                      • Opcode ID: b82c362d3cdaaed20f76486c9ab55f4ec157866222b885b6d12a8261e1309d9d
                      • Instruction ID: 1afc043fa3a32d2f4745f137ac931e11b06ba225519a56190a641513b4daeb4a
                      • Opcode Fuzzy Hash: b82c362d3cdaaed20f76486c9ab55f4ec157866222b885b6d12a8261e1309d9d
                      • Instruction Fuzzy Hash: 2F01F632202B85C9EF458F26E88479873A4E75CF88F188025DB4C47378EF38C9AAC341
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: InitNetworkAddressControl
                      • API String ID: 310444273-1573002242
                      • Opcode ID: 8c17545d40a02c0a3d0541f07b7a17ed477b3f8c665927cb126fde10207ccf64
                      • Instruction ID: 83282d0babe854050122a94296e3d5be1af6fa0602bc649b5bacd95b11cb6375
                      • Opcode Fuzzy Hash: 8c17545d40a02c0a3d0541f07b7a17ed477b3f8c665927cb126fde10207ccf64
                      • Instruction Fuzzy Hash: 4E01A472202B85C5EB568F26E88475873A4E75CF88F189125DB5D47368DF38C9A6C344
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: ImageList_GetImageInfo
                      • API String ID: 310444273-158344479
                      • Opcode ID: 02b43920265ec0d5fc302f9d1c54084f19c9bc365fa1594a1eba101c055afbb6
                      • Instruction ID: 819750bdecd9c332a1743048879b64667d0183303b1621e89f0b4369246aea0b
                      • Opcode Fuzzy Hash: 02b43920265ec0d5fc302f9d1c54084f19c9bc365fa1594a1eba101c055afbb6
                      • Instruction Fuzzy Hash: 3601F632202F85C5EB458F66E88479C73A5E758F98F288029DB4C47378EF38C9A6C341
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: ImageList_ReplaceIcon
                      • API String ID: 310444273-3264144174
                      • Opcode ID: 8472b7689dcb78066942f037ac0502f7787479bef48d9d24bd1e072af3f9b894
                      • Instruction ID: 731c7f6610a579c34efdd3a6cde969e33f10aacd61c8ac5cfd057158e3f8df43
                      • Opcode Fuzzy Hash: 8472b7689dcb78066942f037ac0502f7787479bef48d9d24bd1e072af3f9b894
                      • Instruction Fuzzy Hash: 1201B632212F85C5EB558F26E89575C73A5E758F88F188029DB5D47378DF38C8A6C344
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: ImageList_AddMasked
                      • API String ID: 310444273-822293376
                      • Opcode ID: 7ea77dba61df6d013134bded1ee7b3fbf90e717aa718607b050de2ea0045abb9
                      • Instruction ID: 5e70c24120ae2c2c6515db2624f7a9599ef060d4e759f9bff8b05e54d3ec3e65
                      • Opcode Fuzzy Hash: 7ea77dba61df6d013134bded1ee7b3fbf90e717aa718607b050de2ea0045abb9
                      • Instruction Fuzzy Hash: C401BB32212B85C5DB569F26E88479873A5E758F88F188035DB4D47378DF38C8D6D350
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: GetOpenFileNameW
                      • API String ID: 310444273-1384924626
                      • Opcode ID: 05ca5829b7c74792ce3569bdb4717f8a5d4cdf214f8cc1eaea7dc0b2e467423d
                      • Instruction ID: 55efa486bb266c4982af30de83fc39c5aafaefa1b4f1682a8cbe0630c43c39e2
                      • Opcode Fuzzy Hash: 05ca5829b7c74792ce3569bdb4717f8a5d4cdf214f8cc1eaea7dc0b2e467423d
                      • Instruction Fuzzy Hash: 2E01E432202B45C9EF558F66E88475873A9E75CF98F289025DB4D47778DF38C8A6C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: GetSaveFileNameW
                      • API String ID: 310444273-611885661
                      • Opcode ID: 77526b237bb6f16eab962d79d8836eee063a4455a670587652b256413fb38bcd
                      • Instruction ID: a280bac567392f4669dbdfd5145c0a300b5b1a356a60c9051d8f05cea39b92fe
                      • Opcode Fuzzy Hash: 77526b237bb6f16eab962d79d8836eee063a4455a670587652b256413fb38bcd
                      • Instruction Fuzzy Hash: BA01E432202B45C9EF458F26E88439873A9E758F98F289425DB4D47768DF38C8E6C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressHandleLibraryLoadModuleProc
                      • String ID: ImageList_Create
                      • API String ID: 310444273-2409378823
                      • Opcode ID: a97fec5ba0b37b803da6770632de293d744ad88c6a3474bd50e97142596b0e4b
                      • Instruction ID: 24dc1a4f09648e0cac7cc0494bb65fc22657b5dbd9683be487207d4aa374c17b
                      • Opcode Fuzzy Hash: a97fec5ba0b37b803da6770632de293d744ad88c6a3474bd50e97142596b0e4b
                      • Instruction Fuzzy Hash: 8901A432212B45C5EB558F26E88479963A5E75CF88F189025DB5D47378DF38C8A6C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Rect$ErrorLast$ActivateDeactivateUnionVisible
                      • String ID:
                      • API String ID: 1581547046-0
                      • Opcode ID: 078f944b1e312db265c20bd56b828524ce67d0572fe35cecbd369e23e9dbc4e5
                      • Instruction ID: dc19da286d3d9615509094a4f7c44b8340da0735ac3e1297288acd83d42f0c1e
                      • Opcode Fuzzy Hash: 078f944b1e312db265c20bd56b828524ce67d0572fe35cecbd369e23e9dbc4e5
                      • Instruction Fuzzy Hash: 57F14472301A8182EB56EB37D5543EE23A5BB88FD4F448226EF1A4B7A5EF39C445C300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CompatibleCreate$BitmapObjectSelect
                      • String ID:
                      • API String ID: 4217721833-0
                      • Opcode ID: 573d5333800de022044d62600d0c6420edb898773ddd7ee88788eb2c3d006aae
                      • Instruction ID: 1ec0e95bfff6fb8092e2d6e5a6d9965a47f27cc5b909980f8c67f64e61f66584
                      • Opcode Fuzzy Hash: 573d5333800de022044d62600d0c6420edb898773ddd7ee88788eb2c3d006aae
                      • Instruction Fuzzy Hash: DBB16272B05A508AEB15CFB6D4503ED37B1F748798F51412AEF0DA7BA8DA34D845C780
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Empty$StateWindow
                      • String ID:
                      • API String ID: 2684165152-0
                      • Opcode ID: 61823af8c96e78e4c0469ea68bed5abe0c59dbc715510929a21b8bfb7051a7bb
                      • Instruction ID: c8e2be4fc5aa9c5ac0b6bb00bf330a0655bfbfb14e56c68bf75530deed0d18f0
                      • Opcode Fuzzy Hash: 61823af8c96e78e4c0469ea68bed5abe0c59dbc715510929a21b8bfb7051a7bb
                      • Instruction Fuzzy Hash: A59178722006818AEB66DB63D944BED33A5FB8CBC4F048116EF49477A9DF39C586C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$ClientCopyInfoParametersSystemWindow
                      • String ID:
                      • API String ID: 1264264222-0
                      • Opcode ID: 4e92aa03f0dc65738e7b944351ddbf3cdc80218c137b71844a5c1f725f93b54e
                      • Instruction ID: fe463c96152250ed2edf36fc867da26f60c8fed702f2cc3bb632dbe2c93c9d15
                      • Opcode Fuzzy Hash: 4e92aa03f0dc65738e7b944351ddbf3cdc80218c137b71844a5c1f725f93b54e
                      • Instruction Fuzzy Hash: CA813333B006418EEB26CFAAE485BED33B1F748788F004915EF4A67A68DA75D945CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Global$lstrcmp$FlagsFreeLockUnlock
                      • String ID:
                      • API String ID: 3158084856-0
                      • Opcode ID: 479b9b7176ec6153c4796c773e28a5adbae128ee971789357ce5e1bf3fb211ed
                      • Instruction ID: 918fe8502ec3fce41ceefed1bcef9443fc909589691a959159e971bf7bd856f9
                      • Opcode Fuzzy Hash: 479b9b7176ec6153c4796c773e28a5adbae128ee971789357ce5e1bf3fb211ed
                      • Instruction Fuzzy Hash: CA916C36201A8185EB669F2AD4947EC23A4FB88FA8F554226EB2E4B7F5DF34C544D340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Resource$FindFreeLoadLock
                      • String ID:
                      • API String ID: 1078018258-0
                      • Opcode ID: d80ca1d5c8e92a13695bff74e55d463e30a15e6496dc39ff1804bee5460c434f
                      • Instruction ID: b70ce8a7fd3249db4389933f1d2ff9559ebec5549d5bdca2eeb7575747564809
                      • Opcode Fuzzy Hash: d80ca1d5c8e92a13695bff74e55d463e30a15e6496dc39ff1804bee5460c434f
                      • Instruction Fuzzy Hash: 1371C472604A818AE7669F27A4507EEA7A0FB8CFD4F058635BF4A577B4EB38C4408704
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$AllocGlobal
                      • String ID:
                      • API String ID: 1652254935-0
                      • Opcode ID: 016e47ac5d006dd341e9cbb9d984803cdd8247b662b06398390c588ab957f4ae
                      • Instruction ID: 4d51812aa033dd854bebb536c52803b87e26ccf25cfb77c897f2ce99905ab9ec
                      • Opcode Fuzzy Hash: 016e47ac5d006dd341e9cbb9d984803cdd8247b662b06398390c588ab957f4ae
                      • Instruction Fuzzy Hash: 41617776711A548AE711CFAAC840BDD37A2F788B98F504126EF1D57BA8CF38D456C780
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Menu$RedrawSystemWindow
                      • String ID:
                      • API String ID: 3438490404-0
                      • Opcode ID: 6a15be9ae025efcd51fd30fc7c3c607b80d03a9fa8771276d7431ad1e30c8ff2
                      • Instruction ID: 3c12b01ed0f4d643e913ef244f40ffe688becf8e9422a2f8901cc9ca285a151d
                      • Opcode Fuzzy Hash: 6a15be9ae025efcd51fd30fc7c3c607b80d03a9fa8771276d7431ad1e30c8ff2
                      • Instruction Fuzzy Hash: 99618E72701A808AEB1ADF67D4547ED27A1FB88BC4F144525EF1A5BBA9EF35C480C300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSendWindow$RedrawVisible
                      • String ID:
                      • API String ID: 2376333906-0
                      • Opcode ID: 7df965896fdfca4c366d78e089b699b8fb7916de9f537f63a44d477b5c7582d4
                      • Instruction ID: 58bc0a5ff7c2e65848f1606e11de1751c5288edaa5738109c1e44da7721ce27d
                      • Opcode Fuzzy Hash: 7df965896fdfca4c366d78e089b699b8fb7916de9f537f63a44d477b5c7582d4
                      • Instruction Fuzzy Hash: 24615737201A8087EB66DF27D4547A963A1FB88FC4F588125EF0A0BBA5DF39D652C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Close$Value$EnumQuery
                      • String ID:
                      • API String ID: 4149552890-0
                      • Opcode ID: 6ad8df28d454851027005662d5b6419c0b619f327f5fc7bc8d5284796b485318
                      • Instruction ID: 5f0c7d9c46e3164bb81cd81b810238ffe28d1a58d4104084023bd5c2f58c4329
                      • Opcode Fuzzy Hash: 6ad8df28d454851027005662d5b6419c0b619f327f5fc7bc8d5284796b485318
                      • Instruction Fuzzy Hash: D8518F32215B8086EB11DF26E8447CE77A0F789BE8F544216EB595BBB8DF39C545CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: String$AllocFree
                      • String ID:
                      • API String ID: 344208780-0
                      • Opcode ID: f88b7342ab1ca2ca498b45dcd9ff8184317367a6c7d4d09b4d440e40f68ec9ed
                      • Instruction ID: 59109d8955bdb065399a114772bf6712e264042b41a4a266bc32650cb236c890
                      • Opcode Fuzzy Hash: f88b7342ab1ca2ca498b45dcd9ff8184317367a6c7d4d09b4d440e40f68ec9ed
                      • Instruction Fuzzy Hash: 1251A072701A808AE765CF6AE8447DD33A1F748BA8F144229EF295BBE8DF39C445C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: EmptyRect
                      • String ID:
                      • API String ID: 2270935405-0
                      • Opcode ID: 5a760c8a9ac0bf64e092222e332b33587a21e91909cad0c9a2c24401219509b9
                      • Instruction ID: ad664635fd270bcf4fd163b37198920a45d3a4c2be6e7ae724b819740219514f
                      • Opcode Fuzzy Hash: 5a760c8a9ac0bf64e092222e332b33587a21e91909cad0c9a2c24401219509b9
                      • Instruction Fuzzy Hash: 27610972611B91DBE72ACF26D9447DC77A8F308B94F14022AF765837A0CB759572CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: VisibleWindow$MessageSend
                      • String ID:
                      • API String ID: 1727553256-0
                      • Opcode ID: 4eba12b57759a921ccba5e2fb9463630bc09e94120260adb4475451f2abcac6d
                      • Instruction ID: 73486a81a77f246dd9c6a113e2b3c7efe4bfee044dfd3c3b4b47442ebbf66931
                      • Opcode Fuzzy Hash: 4eba12b57759a921ccba5e2fb9463630bc09e94120260adb4475451f2abcac6d
                      • Instruction Fuzzy Hash: 13517336701A8182EB1A9F27D85139E63A1FB89FE4F148225FB6A477F5DF78C8418740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: BitmapMenu$BitmapsCheckCreateDimensionsItemLoadMark
                      • String ID:
                      • API String ID: 527726921-0
                      • Opcode ID: ff60ce47035d1d6ada0cdc0df5b12ce4529c820c23e6626b4f25455a11ad2c57
                      • Instruction ID: 7b950b4d300ef0c55dc20ab886cbff109510df46459207605fbea25862bbf4db
                      • Opcode Fuzzy Hash: ff60ce47035d1d6ada0cdc0df5b12ce4529c820c23e6626b4f25455a11ad2c57
                      • Instruction Fuzzy Hash: 7F512072710B88C6EB11EF22E848BDD73A1F74CB85F844126EB4947B60EB38D954C780
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Menu$AppendCheckCreateItemPopupWindow
                      • String ID:
                      • API String ID: 2012662573-0
                      • Opcode ID: cdd2ecd8bca10fd0afb0a733ce60067f13e55651646356c7753148d3d830303b
                      • Instruction ID: 96a44a7f04c6d161235733b107f0da1404b48462437c360d151f4f557c30ad72
                      • Opcode Fuzzy Hash: cdd2ecd8bca10fd0afb0a733ce60067f13e55651646356c7753148d3d830303b
                      • Instruction Fuzzy Hash: 2D516736720A1486EB169B27D8157ED23A0BB8DBE4F44422AEF1997BE4DF38C955C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$ClientCursorScreen
                      • String ID:
                      • API String ID: 41388912-0
                      • Opcode ID: 6855740f3edd6283d022cfc83e01f12eb853fcaa6ed29f6a028b211394718d67
                      • Instruction ID: 96f7d8397e8a14c0577eb94fef6de7b146588272fec2880d629e74b9cfcb368a
                      • Opcode Fuzzy Hash: 6855740f3edd6283d022cfc83e01f12eb853fcaa6ed29f6a028b211394718d67
                      • Instruction Fuzzy Hash: 1A516E72201A8182EB65DB2AE880BD973A1FB88BD4F445226EB5D477B5DF78C854C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CaptureMessageRectReleaseSendWindow
                      • String ID:
                      • API String ID: 2919155594-0
                      • Opcode ID: 9bc112919f0731c7ac691f658041dfc7ebf7d07059597ac51f1d9d2a57da9f8b
                      • Instruction ID: 1a88a3601d88ceac9f7ddb421c8275abd2cbf99b11be141409a9c461ee3def86
                      • Opcode Fuzzy Hash: 9bc112919f0731c7ac691f658041dfc7ebf7d07059597ac51f1d9d2a57da9f8b
                      • Instruction Fuzzy Hash: D6513F36601B8086EB51DF62E4947DC73A8F788B98F484236EF494BBA8DF78C541C720
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$Window$malloc
                      • String ID:
                      • API String ID: 986012140-0
                      • Opcode ID: deb3bf461786bda4edee9d504e99374551c393b250ca9585d7e4b909f1338e3d
                      • Instruction ID: e2faaf6c29d9f2e0ca764f698be88f3f8d58738dd606224842e70a1d963748ac
                      • Opcode Fuzzy Hash: deb3bf461786bda4edee9d504e99374551c393b250ca9585d7e4b909f1338e3d
                      • Instruction Fuzzy Hash: 27419872315A8483EB169B67E8547EE6361F789BE4F444229BB6E47BF5DE3CC8048700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: FreeString$ActivateClearVariant
                      • String ID:
                      • API String ID: 245964860-0
                      • Opcode ID: 1d5ef34de28767fc696c93533414c9cb2b0889aec59e06e7f67c9bb162d722b5
                      • Instruction ID: 3be149b94f5995c72db4cea8a874ee0869afcf883e4c5785e1e517b515b67cf8
                      • Opcode Fuzzy Hash: 1d5ef34de28767fc696c93533414c9cb2b0889aec59e06e7f67c9bb162d722b5
                      • Instruction Fuzzy Hash: F8513832700A45DAEB66DFA6D4503DD33B0FB48B88F44402AEF1A57A69DF39D958C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: EmptyRectRedrawWindow
                      • String ID:
                      • API String ID: 1437620686-0
                      • Opcode ID: 5f5e89573fd780a642c6d276b1bf324720922cd74476abe9211442db3e68846d
                      • Instruction ID: 61f68cba2fdef5ba1187f50a0a2e50e33c76dd32c6d76cd6924ec53948bd142b
                      • Opcode Fuzzy Hash: 5f5e89573fd780a642c6d276b1bf324720922cd74476abe9211442db3e68846d
                      • Instruction Fuzzy Hash: CE418C32614A8083EB26CB2AE550BEE73A1F78CFC8F544121EF8947A69DB3CD4418F00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$Offset$ColorCompatibleCreateFillText
                      • String ID:
                      • API String ID: 1625284823-0
                      • Opcode ID: d1aef7633a82f826ddf70642cf96eb65b8585e30c6ee00cf321394a3ae65abe8
                      • Instruction ID: 2f828814aed5b53e158201fd82166791adde8e8b0c0d3c94339a0821b4c10f98
                      • Opcode Fuzzy Hash: d1aef7633a82f826ddf70642cf96eb65b8585e30c6ee00cf321394a3ae65abe8
                      • Instruction Fuzzy Hash: 8031503131468086EB229B53AA48BDAB761F78DFE5F004225AF5907BF4DB78C901CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Object$EntriesPaletteParentStock
                      • String ID:
                      • API String ID: 4188070286-0
                      • Opcode ID: 1a0d59185c63ef169eac0c7a70781ed32b4e59d11be5f66697425b5950b6daa8
                      • Instruction ID: b0372cc994c18d30d38cba0aeae4de1fe3bf471c7abecb1a640c26b6c9389a4d
                      • Opcode Fuzzy Hash: 1a0d59185c63ef169eac0c7a70781ed32b4e59d11be5f66697425b5950b6daa8
                      • Instruction Fuzzy Hash: 5231043220168096EB169B67E4407EAB760F78DFE8F140126FF69577F6DB38C8468700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Rect$ClientEmptyWindow
                      • String ID:
                      • API String ID: 742297903-0
                      • Opcode ID: beb5cae759a8d69099b2093ecbdbf96782d98a1d38125124acc0d44c8aa93de6
                      • Instruction ID: d1c19c334ab1bb071714c12d7f869e0afc9b01fe7549ef276c5f7186da2337f2
                      • Opcode Fuzzy Hash: beb5cae759a8d69099b2093ecbdbf96782d98a1d38125124acc0d44c8aa93de6
                      • Instruction Fuzzy Hash: 92314876214A848BEB25DB27E19476AB3A0F78CBD9F108121EF9E47B64DF38D551CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Activate$ClassErrorLastLongMessageSend$Deactivate
                      • String ID:
                      • API String ID: 348901367-0
                      • Opcode ID: 1cc79a1cecf66d2841748679676a32714c760c96eb9e7788eb96c3ce52e25026
                      • Instruction ID: 4a4cc9aa4dd03f82f535d4a1057877c534e4376ed868d5af3958679a219e8640
                      • Opcode Fuzzy Hash: 1cc79a1cecf66d2841748679676a32714c760c96eb9e7788eb96c3ce52e25026
                      • Instruction Fuzzy Hash: FE313C76311A8082EF62DB26E490BD963A1FBC9BE4F444221FB5D4BBE5DF39C4448741
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Palette$Entries$CreateObjectSystemmalloc
                      • String ID:
                      • API String ID: 3480014781-0
                      • Opcode ID: 1204c6bbee314c6bc55367e2cb91cde81f0008b5b89b362f4134647dd0b1ad2b
                      • Instruction ID: 816ada887ff9c2cb779ec99d855012dae29cba31d117e727d860353266c3266c
                      • Opcode Fuzzy Hash: 1204c6bbee314c6bc55367e2cb91cde81f0008b5b89b362f4134647dd0b1ad2b
                      • Instruction Fuzzy Hash: F0312B36215A8082EB16DF22E4543EAB7A1FB8CBD0F588225EB9D47BB5DF38C541C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: TextWindow$ItemLengthwcsnlen
                      • String ID:
                      • API String ID: 2196709654-0
                      • Opcode ID: a5ac910acf556d330ead6681900faef29f2b58b66d1456dc7a82513b87287207
                      • Instruction ID: 57f3ca399286f11ee64f33fc9311dc500e832543ab777ccbe54d73720a1dc1ad
                      • Opcode Fuzzy Hash: a5ac910acf556d330ead6681900faef29f2b58b66d1456dc7a82513b87287207
                      • Instruction Fuzzy Hash: E3215E35702A4082EB56EB1BE5943AD67A1BB8CFC0F144125EF5E4B7A9DF39C4618780
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSendlstrlen
                      • String ID:
                      • API String ID: 1933689666-0
                      • Opcode ID: 7fa9105e47298506a423ade23c0b93766cdc0294a98b0b3964ff5addc2cc7086
                      • Instruction ID: 644ea9a0efcba1e1918e52a777b0a58605fd37e0fb82968df2a339ee1313b243
                      • Opcode Fuzzy Hash: 7fa9105e47298506a423ade23c0b93766cdc0294a98b0b3964ff5addc2cc7086
                      • Instruction Fuzzy Hash: 1921483A600A8486EB51DF26D494B9D77A0F7CCFC4F694125EF9A43B68CF39C5468B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Rect$CreateRound
                      • String ID:
                      • API String ID: 4208751637-0
                      • Opcode ID: 3160bb2272c68159466e99bacdcc0318d80dac75c5c7edc592cb9839dba434fc
                      • Instruction ID: 0f713d2500470e497af3c03b70e7008698ad20239ac20fba8ea9ca0a24c5689c
                      • Opcode Fuzzy Hash: 3160bb2272c68159466e99bacdcc0318d80dac75c5c7edc592cb9839dba434fc
                      • Instruction Fuzzy Hash: C8312832B10B508AE721CB66E885BDD37B4F749B98F150225AF5957BA8DF39C5418700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Cursor$ClientRectScreen
                      • String ID:
                      • API String ID: 2390797981-0
                      • Opcode ID: 69479461b0493033759f7bd7f637dd5acda53cd06e1bec4f9806efbe753b66f9
                      • Instruction ID: e69440535f669f458aca84c3e92d5729cc3f2cb872dd82815460d4180383a7e9
                      • Opcode Fuzzy Hash: 69479461b0493033759f7bd7f637dd5acda53cd06e1bec4f9806efbe753b66f9
                      • Instruction Fuzzy Hash: 1D316B32204945C6EB229F26E9897EE73B0F788BD9F540435EB49472A8DF38C944CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Resource$FindFreeLoadLock
                      • String ID:
                      • API String ID: 1078018258-0
                      • Opcode ID: 327b983b83447a5e0ef21f26b3fb1d8c10e96ed776aef055ae3468024f2a9950
                      • Instruction ID: 8f31a042630d2e0f319ec35f4b608e95fb5906735535a3275fb55d43a906d7ba
                      • Opcode Fuzzy Hash: 327b983b83447a5e0ef21f26b3fb1d8c10e96ed776aef055ae3468024f2a9950
                      • Instruction Fuzzy Hash: 48212676301B9081EA16EB57A848BD9A7A5FB8EFD4F494029EF094BB65DF38C945C300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: KillMessageParentSendTimer
                      • String ID:
                      • API String ID: 2710755332-0
                      • Opcode ID: 8e7861c84e35063d668d676bb1bdeb246f3f855a78247ca470c63ce6aa49c848
                      • Instruction ID: c6af386f585a42b20a12284c11071271bfa2fca30757cc873f1ab1092e763a95
                      • Opcode Fuzzy Hash: 8e7861c84e35063d668d676bb1bdeb246f3f855a78247ca470c63ce6aa49c848
                      • Instruction Fuzzy Hash: 3D217132604A8482EB56AF22E4457D937A0F78AFE9F144635EF69077E5CF74C6548300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: EmptyRect$CursorState
                      • String ID:
                      • API String ID: 2369637639-0
                      • Opcode ID: 2507f412434602ad867a3c54f6f855884f40b04f4bc144c43aeea1748a0201fb
                      • Instruction ID: 762b10e611ab2f440d20bc35d170b798e4586236b7a136e4a74b246c9b01fbdd
                      • Opcode Fuzzy Hash: 2507f412434602ad867a3c54f6f855884f40b04f4bc144c43aeea1748a0201fb
                      • Instruction Fuzzy Hash: D6212432610A5089FB11CB62A8447DD73B8F74CBD8F840126AF4967B68DF39C5918750
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateDeactivate
                      • String ID:
                      • API String ID: 2261068335-0
                      • Opcode ID: 3f8354b81729116b2bb8154540c6985c61a87962521920cec33804e53421579f
                      • Instruction ID: b861f16bfec65c2b5c99347523160ff735e53e8f5243931d690a8cb84a602fad
                      • Opcode Fuzzy Hash: 3f8354b81729116b2bb8154540c6985c61a87962521920cec33804e53421579f
                      • Instruction Fuzzy Hash: 00218C32314B8192E7919B67A88179EB2E9FBCCFC0F584025EF4A87B64DF78C8458700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Resource$FindFreeGlobalLoadLock
                      • String ID:
                      • API String ID: 3898064442-0
                      • Opcode ID: 36a671701df03b1eff74ffc63777d89676a0ca3cf23794d83bd475b41a6559d4
                      • Instruction ID: 35ed3562b111b86dd37399760da080693b5d66925a797d0b3ca35ec0a754e942
                      • Opcode Fuzzy Hash: 36a671701df03b1eff74ffc63777d89676a0ca3cf23794d83bd475b41a6559d4
                      • Instruction Fuzzy Hash: E4218075201B8086FB5A9B2395443DDB2A5EB4CFC4F488419DF4D1BBA9DF38C8958740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Global$AllocLockUnlockmemcpy_s
                      • String ID:
                      • API String ID: 2323231100-0
                      • Opcode ID: 858feefc28c33c49f6aaa5ffd462fd7ab53161935ba50899021217727ace764c
                      • Instruction ID: 44acfd20d9ca8c2c727867f827ca879f3664f7b50a280fe08791e912e25c6aa1
                      • Opcode Fuzzy Hash: 858feefc28c33c49f6aaa5ffd462fd7ab53161935ba50899021217727ace764c
                      • Instruction Fuzzy Hash: F511B23520164196FB6B9F97E4857EC63A0EB4CBC0F18882AFB19877B5DF38C8908700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateDeactivate
                      • String ID:
                      • API String ID: 2261068335-0
                      • Opcode ID: 6bf56cacf05402e3ff8829ae9d934b1f8dbd3e28322b75b7fa0ddd7f7c4fcfb4
                      • Instruction ID: 83dd82d4350079794ced799b6cca64c1439ea0508064b259ddc804ea5df4eed6
                      • Opcode Fuzzy Hash: 6bf56cacf05402e3ff8829ae9d934b1f8dbd3e28322b75b7fa0ddd7f7c4fcfb4
                      • Instruction Fuzzy Hash: D0218E32310B9582EB529B67A88539AA2A4FBCDFD4F494035EF498B764DFBCC8458740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateDeactivate
                      • String ID:
                      • API String ID: 2261068335-0
                      • Opcode ID: 6ee816c23a1fc399d81abdf6909574f037947a1ab8983fef82944c7557a843b2
                      • Instruction ID: 5b60bb146dacc5006875f7f7a84d9d39fac7f5933fb290a91ea5ec6fb359ea91
                      • Opcode Fuzzy Hash: 6ee816c23a1fc399d81abdf6909574f037947a1ab8983fef82944c7557a843b2
                      • Instruction Fuzzy Hash: 7021A232310B8582E7129F67A88179D6795FB8CFE0F484629EB59877A4CF78C8458301
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateDeactivate
                      • String ID:
                      • API String ID: 2261068335-0
                      • Opcode ID: 86778ab83963495feb20d09f389ea80c24f4aa4075bdf6f36f20cd351333f891
                      • Instruction ID: 6f64cab471d8d9c9406d1ef187a0bab3bd9451c1aebf36a5fb73609363a0e568
                      • Opcode Fuzzy Hash: 86778ab83963495feb20d09f389ea80c24f4aa4075bdf6f36f20cd351333f891
                      • Instruction Fuzzy Hash: 4621A232210B4182E7219F67A88179967A4FB8CFE0F584229EF59877A4CF78C8458700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateAddressDeactivateHandleLibraryLoadModuleProc
                      • String ID:
                      • API String ID: 1520649096-0
                      • Opcode ID: fbdd546538bdf94e83e705ca05b90b497fc2896d3a1e082d416da813b2e3cc11
                      • Instruction ID: 2b14851de44b0208fe39882d09dcce88c2b9e3e7da3f41d0a2d081f4ae9f3d64
                      • Opcode Fuzzy Hash: fbdd546538bdf94e83e705ca05b90b497fc2896d3a1e082d416da813b2e3cc11
                      • Instruction Fuzzy Hash: 36118B32300B8182EB519F77A88139AA3E6FB8CFD0F584525EF098B764CF78C8858700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MessageSend$ParentRedrawWindow
                      • String ID:
                      • API String ID: 2139789815-0
                      • Opcode ID: 28ca2fac884ce83bb51a2465fd4433591020349f8db504929621570f91c2b948
                      • Instruction ID: 1756492762ff014d37d76c9c393f0ea66be077feb02d5ea2c033f60711b6c76f
                      • Opcode Fuzzy Hash: 28ca2fac884ce83bb51a2465fd4433591020349f8db504929621570f91c2b948
                      • Instruction Fuzzy Hash: E3117C3671468083FB669B27E590BAA63A1F78DBC4F448424EF0E47BA4DF39C5458B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Close$PrivateProfileStringValueWriteswprintf
                      • String ID:
                      • API String ID: 581541481-0
                      • Opcode ID: 5207dd9e152ad493f13b01abc862abbec95636334e3ea8a785f08f75ce7eab33
                      • Instruction ID: fc688cab9c78bcbd9aad5169f75602ce6c09a284e1772bdb1ca5d3fee44e8537
                      • Opcode Fuzzy Hash: 5207dd9e152ad493f13b01abc862abbec95636334e3ea8a785f08f75ce7eab33
                      • Instruction Fuzzy Hash: 8011A372315B9442EB529B63B855BDA6364E78DFD9F884031BF0E17B64DF38C5468B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CurrentProcess$DuplicateErrorHandleLastmalloc
                      • String ID:
                      • API String ID: 1283020281-0
                      • Opcode ID: 4feb2ed86f5a111a4e96f0ff319d5ec4de1c1529d0d56765822672051d86fa6f
                      • Instruction ID: c07cbf2101ee197e89f1e7c3f9b7a8c17547f15550a4ce0017898ad7b5222ad2
                      • Opcode Fuzzy Hash: 4feb2ed86f5a111a4e96f0ff319d5ec4de1c1529d0d56765822672051d86fa6f
                      • Instruction Fuzzy Hash: 29212C36605B4487EB619B27E58439AB3A1F78CBD0F144229EBAD43BA9DF3CD451CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: EnableFocusItemMenuMessageParentSend
                      • String ID:
                      • API String ID: 2297321873-0
                      • Opcode ID: 7f032abf3cab5b262fad2dc5b3863c65a2f07b2dd77ac9c40b81fe7bbdad5e76
                      • Instruction ID: a7adc0c8e989bf99d2c7632d6d06c5ccc53ccc2177d72c3b4f93e0aef10ac57f
                      • Opcode Fuzzy Hash: 7f032abf3cab5b262fad2dc5b3863c65a2f07b2dd77ac9c40b81fe7bbdad5e76
                      • Instruction Fuzzy Hash: 54118BB6620590C2EB66DF23F4507A96370F788F88F204211FB5A47A69CF79C8818744
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Item
                      • String ID:
                      • API String ID: 369458955-0
                      • Opcode ID: e636cce0b887eead359fe3789852b5aa3d8db69ee4c6132a36baf01287e95e64
                      • Instruction ID: 4b6a66930765b0b32a21ab87150bb62e52c9a9cde51b09a38a1941f6515904e4
                      • Opcode Fuzzy Hash: e636cce0b887eead359fe3789852b5aa3d8db69ee4c6132a36baf01287e95e64
                      • Instruction Fuzzy Hash: 1E112E7030578141EE66DB1774447B9A2909F9CFC0F189438BF4943B77EF39D451A640
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Color$ObjectText
                      • String ID:
                      • API String ID: 829078354-0
                      • Opcode ID: e321e311f1532cdca9fb0ae761378fd264ced305db27d4657a141e8b49dece4a
                      • Instruction ID: f7dea7a8ff3b2db4c033361b52b366ae4e97154a765a5bc1c26c7789598cd7bb
                      • Opcode Fuzzy Hash: e321e311f1532cdca9fb0ae761378fd264ced305db27d4657a141e8b49dece4a
                      • Instruction Fuzzy Hash: E111A07072560846FE66C767B554BE962D1AB9CBD4F244132EF4A47BB4CE3CCC414A00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • ActivateActCtx.KERNEL32 ref: 000000014000E364
                        • Part of subcall function 000000014000E2C4: GetModuleHandleW.KERNEL32(?,?,00080000,000000014000F5A3,?,?,00000400,0000000140013249), ref: 000000014000E2E6
                        • Part of subcall function 000000014000E2C4: LoadLibraryW.KERNEL32(?,?,00080000,000000014000F5A3,?,?,00000400,0000000140013249), ref: 000000014000E2F9
                        • Part of subcall function 000000014000E2C4: GetProcAddress.KERNEL32(?,?,00080000,000000014000F5A3,?,?,00000400,0000000140013249), ref: 000000014000E317
                      • GetLastError.KERNEL32 ref: 000000014000E3AC
                      • DeactivateActCtx.KERNEL32 ref: 000000014000E3BF
                      • SetLastError.KERNEL32 ref: 000000014000E3CB
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateAddressDeactivateHandleLibraryLoadModuleProc
                      • String ID:
                      • API String ID: 1520649096-0
                      • Opcode ID: 4c26f83d958abce418434e30609bc5026db76866080aa55d1ae837455ac7dd3c
                      • Instruction ID: 43fa863c25c286084b3f815209fde8b4beaaca76caffc54606b6603626d21ace
                      • Opcode Fuzzy Hash: 4c26f83d958abce418434e30609bc5026db76866080aa55d1ae837455ac7dd3c
                      • Instruction Fuzzy Hash: 2A11737220479182E712DBA7B44539EA7A4FB8CBD4F484125EF4997664DFB8C9458700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Menu$Item$Count
                      • String ID:
                      • API String ID: 879546783-0
                      • Opcode ID: 5beaeb01dacd2240d03e88f0f1c95005c4227e4e2fcc02d18c8290d5b19dcc27
                      • Instruction ID: 5b3018e1b4b9a16d0f51196cc63d842e1276d69d7b72f9deef97d0fc84d164f1
                      • Opcode Fuzzy Hash: 5beaeb01dacd2240d03e88f0f1c95005c4227e4e2fcc02d18c8290d5b19dcc27
                      • Instruction Fuzzy Hash: 5B116D3A714B4581FA568B77E5843A972A2FB8CFC0F254824EF1A93765DF39C5418340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateAddressDeactivateHandleLibraryLoadModuleProc
                      • String ID:
                      • API String ID: 1520649096-0
                      • Opcode ID: eacc750954b9a7f696da4a4c0df30f4cbef966f32fc28b690133b70535c4f3e2
                      • Instruction ID: 159ab3ac156c802c825a0038e683629474d16579b78487cc69911bdd68156508
                      • Opcode Fuzzy Hash: eacc750954b9a7f696da4a4c0df30f4cbef966f32fc28b690133b70535c4f3e2
                      • Instruction Fuzzy Hash: 0D11863230478282EB119F67E84439EA3E5FB8CBD4F694525EF498BA64DFB8C8458700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateAddressDeactivateHandleLibraryLoadModuleProc
                      • String ID:
                      • API String ID: 1520649096-0
                      • Opcode ID: f5ffe8ce361d20a3dac4056a3087b073c3883657739f52f3dcbcb1a80262fc88
                      • Instruction ID: ec6cbe2cca4572e270682b380dfa7ef1be61121eddabaac167614057a3cdf4c6
                      • Opcode Fuzzy Hash: f5ffe8ce361d20a3dac4056a3087b073c3883657739f52f3dcbcb1a80262fc88
                      • Instruction Fuzzy Hash: B211A33220478282E7119BA7E88039EA3E9FB8CBD4F594524EF4987A64DFB8C8458700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      • ActivateActCtx.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000014000F67E), ref: 000000014000E481
                        • Part of subcall function 000000014000E3E4: GetModuleHandleW.KERNEL32 ref: 000000014000E406
                        • Part of subcall function 000000014000E3E4: LoadLibraryW.KERNEL32 ref: 000000014000E419
                        • Part of subcall function 000000014000E3E4: GetProcAddress.KERNEL32 ref: 000000014000E437
                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000014000F67E), ref: 000000014000E4C7
                      • DeactivateActCtx.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000014000F67E), ref: 000000014000E4DA
                      • SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000014000F67E), ref: 000000014000E4E6
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ErrorLast$ActivateAddressDeactivateHandleLibraryLoadModuleProc
                      • String ID:
                      • API String ID: 1520649096-0
                      • Opcode ID: 518a2360267f0a33aacf9225b4928b05be3f914bff47035cfba15546081971e2
                      • Instruction ID: 3a844b7ed865a9efa37f5f45d1437b58b220f014e619b77fc48a66e7692e078b
                      • Opcode Fuzzy Hash: 518a2360267f0a33aacf9225b4928b05be3f914bff47035cfba15546081971e2
                      • Instruction Fuzzy Hash: C6118E72204A8182E7229F26F84039EA3B0FB8CBC4F554125FF59977A9DF7CC8458704
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Keyboard$LayoutStateUnicodeVirtual
                      • String ID:
                      • API String ID: 961187839-0
                      • Opcode ID: 8bd2d8649b9c5449fed3ef95baed46a2f8a3ce4b9ed12af5f952f4b8f4ba507d
                      • Instruction ID: b9fe27098bcd61d36b32acd2a8910d1dfeca60529b9c01e97095eff08c734710
                      • Opcode Fuzzy Hash: 8bd2d8649b9c5449fed3ef95baed46a2f8a3ce4b9ed12af5f952f4b8f4ba507d
                      • Instruction Fuzzy Hash: A5119132204A8483E721EB22F8557CEB3A5FBCCB84F454126EB4947B69DF78C905CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Destroy
                      • String ID:
                      • API String ID: 3707531092-0
                      • Opcode ID: 7e3fccc88713cf03c25499a5e80ee2794260d7a0d8f71c220c66f8c78f652980
                      • Instruction ID: c8ad90ed63ba0b4df14b5bd0519060aa2e2fed85cb328e23cbaa0eb99cb1ea1b
                      • Opcode Fuzzy Hash: 7e3fccc88713cf03c25499a5e80ee2794260d7a0d8f71c220c66f8c78f652980
                      • Instruction Fuzzy Hash: 39115132605A9882FB96DB33E4943E963A0E78CFD4F184125EF494B3B4DF35C8958740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: RectWindow$CursorFromPoint
                      • String ID:
                      • API String ID: 3445796726-0
                      • Opcode ID: 10153566e4fc346b72a37bed28b6bb0d608666cb4fead96d89931db1d567ec85
                      • Instruction ID: ede703bdce7187f548d9b000ee13a91aaa00aaa03ea6d24defc984ea8f2d32cd
                      • Opcode Fuzzy Hash: 10153566e4fc346b72a37bed28b6bb0d608666cb4fead96d89931db1d567ec85
                      • Instruction Fuzzy Hash: 6711E372714B4182EB218B16F49439AA3A0F78CBE4F890125EF9E47B68CE79C9958740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Resource$FindFreeLoadLock
                      • String ID:
                      • API String ID: 1078018258-0
                      • Opcode ID: cf4f7b5bff23c6c0a29bbf147086021159a35d0cd25b135f94f0c99038b9e39c
                      • Instruction ID: 764a702cc22084be9f6a1ab4f367d170437043bb7e3533d8be13a29d0baccd1a
                      • Opcode Fuzzy Hash: cf4f7b5bff23c6c0a29bbf147086021159a35d0cd25b135f94f0c99038b9e39c
                      • Instruction Fuzzy Hash: 67012875701A8086EA15EB53B888B9AA2A4FB8DFD0F884024EF5907725DF38D4858704
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: MetricsSystem$ClientMessageRectSend
                      • String ID:
                      • API String ID: 2251314529-0
                      • Opcode ID: d215b50d166d05b074f6fe2c685dede19b75f7c6749f3706df48cb33f954c0db
                      • Instruction ID: 35de632cf7cf693fc7487639788797f27e2fd394660016ad2790a5f4bb9c49dc
                      • Opcode Fuzzy Hash: d215b50d166d05b074f6fe2c685dede19b75f7c6749f3706df48cb33f954c0db
                      • Instruction Fuzzy Hash: 6D113C36321B8086EB55CF76E8987AD63E1F78CB94F540525EB4D87B64DF39C8518700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Active$EnableFreeResource
                      • String ID:
                      • API String ID: 3751187028-0
                      • Opcode ID: 1c36c1af632904f5bf6f9d058f196377e9808f11323857d2219f93a020807413
                      • Instruction ID: 376830780768e43b0ee19afb4bca16b7013c0b5e4558e967d95fc6d5acc670b6
                      • Opcode Fuzzy Hash: 1c36c1af632904f5bf6f9d058f196377e9808f11323857d2219f93a020807413
                      • Instruction Fuzzy Hash: 3D015E76309690C2E66ADB13F5443EE6361F788FE5F144011DF4A17BA8CF78C4968701
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$Focus$ChildLongParent
                      • String ID:
                      • API String ID: 1766597969-0
                      • Opcode ID: 8ec277104b861f6336c8545de777ac1cd94ed74cdb2bd657804e936d1be81290
                      • Instruction ID: 68d62abb1cd8adddd61b500fdad37869b0110380687c8b814730f58501cfbdb4
                      • Opcode Fuzzy Hash: 8ec277104b861f6336c8545de777ac1cd94ed74cdb2bd657804e936d1be81290
                      • Instruction Fuzzy Hash: F9F0677630159081EA43EB27B8143EF53A0AB89FD8F000025FF0AAB7B5DF39C8868700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ViewportWindow
                      • String ID:
                      • API String ID: 1589084482-0
                      • Opcode ID: f1a6376054522a90fad5e1642366a1c6d638f88539e2980b53b1c68b7cbae6a5
                      • Instruction ID: c0f50f9f7747a5546a1342e21d05db9b0749f491389eed6adc8809ec63942758
                      • Opcode Fuzzy Hash: f1a6376054522a90fad5e1642366a1c6d638f88539e2980b53b1c68b7cbae6a5
                      • Instruction Fuzzy Hash: 8901563671464087D7499F22F585B9D73A1F78CF80F04A425EB564B76ADF78E850CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ViewportWindow
                      • String ID:
                      • API String ID: 1589084482-0
                      • Opcode ID: 4233740e7a229c712e9de7a8e5ae3100e6dfee7f8262d3d8249565cd6602f505
                      • Instruction ID: 8b43417006aa83a30a308e0695605c519ade9b74f46d1f506a707a172f1a79ce
                      • Opcode Fuzzy Hash: 4233740e7a229c712e9de7a8e5ae3100e6dfee7f8262d3d8249565cd6602f505
                      • Instruction Fuzzy Hash: DD01563671464087D7499F22F585B9D73A1F78CF80F04A425EB564B76ADF78E850CB00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ParentWindow$Long
                      • String ID:
                      • API String ID: 941798831-0
                      • Opcode ID: f95b1e39dab2fb8baa1bcbe7e8049c4e91195b78cc1c559ee1eff881f24b87d8
                      • Instruction ID: c4302c74b9bb1671d59a62dbc30655a14a42426cec277c3e3aad306b4e6bac5a
                      • Opcode Fuzzy Hash: f95b1e39dab2fb8baa1bcbe7e8049c4e91195b78cc1c559ee1eff881f24b87d8
                      • Instruction Fuzzy Hash: 39F04F3021568082FE569B67B5943F91261BB8DFC8F584524FF5A0B7B1DF7AC4458300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: FreeGlobal$CriticalSection$EnterHandleLeaveLocalUnlockValue
                      • String ID:
                      • API String ID: 1402163063-0
                      • Opcode ID: dd6e1ec4871820f50bd11fd4a3c7611ef3bea5384fd6bec459db80401bb41f5e
                      • Instruction ID: 276c8925a9c1ca5ecccfc33257f7d2adadf0ed83952fc752731aef1c639f0003
                      • Opcode Fuzzy Hash: dd6e1ec4871820f50bd11fd4a3c7611ef3bea5384fd6bec459db80401bb41f5e
                      • Instruction Fuzzy Hash: EBF03175301A41C2EE5A9F67D5947A86360FB4EFE4F189220EF190BAB4DF3AC4A5C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l
                      • String ID: %sDockingManager-%d$DockingPaneAndPaneDividers
                      • API String ID: 2941638530-4068244756
                      • Opcode ID: a887b6f1ec2b6ba9bbce977d3b293f2084c4cab05d13cd9a71a6769cab208267
                      • Instruction ID: 78d5bc1c6fecc97af53dad2c265614951b0f194c4270ce5bbe8daa04abb8a786
                      • Opcode Fuzzy Hash: a887b6f1ec2b6ba9bbce977d3b293f2084c4cab05d13cd9a71a6769cab208267
                      • Instruction Fuzzy Hash: 91B18972305E8582EB529B27D840BDE63A1FB88FE4F588612EB5E477A5DF78C845C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l
                      • String ID: %sMDIClientArea-%d$MDITabsState
                      • API String ID: 2941638530-353449602
                      • Opcode ID: 9f81c94cdbdc1cddb183256aa76af593ac41d2ae5150b198774a464ce62df1f3
                      • Instruction ID: 951e0782919e065530def80e6d515ea5f87c7d052f100eaecbb0789b04f9cdf6
                      • Opcode Fuzzy Hash: 9f81c94cdbdc1cddb183256aa76af593ac41d2ae5150b198774a464ce62df1f3
                      • Instruction Fuzzy Hash: EC718E73305A8582EB51DF6AD8407DE63A0FB89BE4F448226EB6E437A5DF78C845C740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID:
                      • String ID: Invalid DateTime
                      • API String ID: 0-2190634649
                      • Opcode ID: 3c46746fe081b0d7ec18927fb0276fe3bd7aca99264ca6547aefb728f5741523
                      • Instruction ID: 108bcf822f121695faf7da809e5d8cdeee6103e6412d0e836bac40c3be00cfac
                      • Opcode Fuzzy Hash: 3c46746fe081b0d7ec18927fb0276fe3bd7aca99264ca6547aefb728f5741523
                      • Instruction Fuzzy Hash: 9F617C72701A4582EB069F3AC8553ED63A4EB89BE4F444616EB2D877F5DF34C845C340
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientMessageRectSend
                      • String ID: ...
                      • API String ID: 166717107-440645147
                      • Opcode ID: d4bdce2c576edad744f89eee4f6425c6bdf1ea4c5b1792d02d804f2119c7f4b7
                      • Instruction ID: 4eb366190c89ed588adf0fa9326515aff52a3ba1acae57ccf844b02b09be6f84
                      • Opcode Fuzzy Hash: d4bdce2c576edad744f89eee4f6425c6bdf1ea4c5b1792d02d804f2119c7f4b7
                      • Instruction Fuzzy Hash: EC519C72B10A808AFB16DF62D8447EC33B1F748BD9F284921EF091BAA9CF79C5418740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Window$AddressHandleModuleProcRect
                      • String ID:
                      • API String ID: 171783891-3916222277
                      • Opcode ID: 4224f591b619f5522c02b2ada9777c58b73b6798dbad2b092dc2b7ce6f7e7411
                      • Instruction ID: 3388f79e16974cb93c2fb808fcf7a9b4cf5be1a33a2d4f03a13bed05aeb0d6a3
                      • Opcode Fuzzy Hash: 4224f591b619f5522c02b2ada9777c58b73b6798dbad2b092dc2b7ce6f7e7411
                      • Instruction Fuzzy Hash: 70518B77B006509AEB6ADF76D6857EE77A0B748BC8F04803AEF19437A4DB308961C700
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _cwprintf_s_l
                      • String ID: %sMFCToolBarParameters$LargeIcons
                      • API String ID: 2941638530-2076908790
                      • Opcode ID: 9281a9f877f833decaaba8650c6533cdb6bad99ab1982595b487b906859da0cc
                      • Instruction ID: 43067373c04678a4e8ffd53e4523f98308d98c0e037da1a7e603470c5cdfa008
                      • Opcode Fuzzy Hash: 9281a9f877f833decaaba8650c6533cdb6bad99ab1982595b487b906859da0cc
                      • Instruction Fuzzy Hash: 58413F72701B4586EB109F6AC84139D23A1FB89FE4F458626EB2D477E4DF78C859C380
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ImageLoadObject
                      • String ID: ...
                      • API String ID: 2222342736-440645147
                      • Opcode ID: d2b9bd03d4a6b1cc750da8bb2915e9f4b749280383c30a05838e29d0ff184b3a
                      • Instruction ID: b2a03226115ff42bfd9d1e2c4f75c54bde34a7805842650ba1122f69e8cf37c8
                      • Opcode Fuzzy Hash: d2b9bd03d4a6b1cc750da8bb2915e9f4b749280383c30a05838e29d0ff184b3a
                      • Instruction Fuzzy Hash: F2417E316216408AF7629F17E458BE977A0E78CBD0F58412ABF4907BA6CB7DC981CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClientRectRedrawWindow
                      • String ID: 4
                      • API String ID: 804678526-4088798008
                      • Opcode ID: 8d8c82c884f6fd6e8bf8ee87f9ddb636cc5a3782340417cc018095684ce0d862
                      • Instruction ID: c5ba25a6e5e48e425a5f8283f5e68a144551032364a3a10d7f43cea7d130cc56
                      • Opcode Fuzzy Hash: 8d8c82c884f6fd6e8bf8ee87f9ddb636cc5a3782340417cc018095684ce0d862
                      • Instruction Fuzzy Hash: 9D415877B20A508BEB15CFA2D4447AD77B0F348B99F044519EF0927B68CB39DA41CB80
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _errno_invalid_parameter_noinfo
                      • String ID: B
                      • API String ID: 2959964966-1255198513
                      • Opcode ID: 78fccfdf3987baf5ddf8a193f0c0de328958b8306ad374332a593ca43157bee0
                      • Instruction ID: ac3d1466f36f06a72cb67af36c5efc75dda74a52d98cf7aa8f991f15a7da8ea4
                      • Opcode Fuzzy Hash: 78fccfdf3987baf5ddf8a193f0c0de328958b8306ad374332a593ca43157bee0
                      • Instruction Fuzzy Hash: 81314C326206608AE712DF7AA4417DD37B4B70CBACF584216EF295BBA8DB36C441C750
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: AddressProc
                      • String ID: ChangeWindowMessageFilter$USER32.DLL
                      • API String ID: 190572456-4180284649
                      • Opcode ID: caadbce5c8d138f9b031c56de317b961b5cdf90db199e332c6ea5091d339f98c
                      • Instruction ID: 4e939c7e9f3b149310225624c38fd79018fd9301bbadb258e33577de10baabfb
                      • Opcode Fuzzy Hash: caadbce5c8d138f9b031c56de317b961b5cdf90db199e332c6ea5091d339f98c
                      • Instruction Fuzzy Hash: 6C215C32611B4182EB029B26E8443DD63A8FB89FD8F484135EF584B7F9DF78D5518710
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: RectWindow$Inflate
                      • String ID: iii
                      • API String ID: 1974394720-940974255
                      • Opcode ID: 96105a936e80882ab6a0782b12329dcbe2b81ea0b0b26020159e19943890d067
                      • Instruction ID: 65a283b63c8b73a494c8e7250a4ba8725c97c6b3fd327865c920f2f1c6175f4e
                      • Opcode Fuzzy Hash: 96105a936e80882ab6a0782b12329dcbe2b81ea0b0b26020159e19943890d067
                      • Instruction Fuzzy Hash: 05211932B20A108EFB11DBB6D8457EC3370F748BA9F444615DF1967AE9DB788A45CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: InflateRect
                      • String ID: iii$
                      • API String ID: 2073123975-462628325
                      • Opcode ID: ffbbacdef9e2007305f611a8569b8fe673a6724e6825943937723462f1d9d177
                      • Instruction ID: d1406657105f7a920805b8a102d1da97ccba27b09cfdd750d1d258459b78df59
                      • Opcode Fuzzy Hash: ffbbacdef9e2007305f611a8569b8fe673a6724e6825943937723462f1d9d177
                      • Instruction Fuzzy Hash: C0214D3265079086E7269B23A808BD9B7A1F78DFD4F084115AF4407BA5CBBCD984CB40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ClipboardFormatRegister_cwprintf_s_l
                      • String ID: ToolbarButton%p
                      • API String ID: 1862559383-899657487
                      • Opcode ID: c2f9855a5087b680bee059b4147f1ceacf934613c7a925915be9a5d84af85b89
                      • Instruction ID: 2ee2c786afe8733bf58ff97afa03b2e4717f0a6e9336f261c9877c69b0763537
                      • Opcode Fuzzy Hash: c2f9855a5087b680bee059b4147f1ceacf934613c7a925915be9a5d84af85b89
                      • Instruction Fuzzy Hash: 5C1160B5244B4182EA1ADB2AE4047AA7360F789BF1F584716EB69436F5DF78C841C300
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: Message$Send$BeepState
                      • String ID: .
                      • API String ID: 4005977132-248832578
                      • Opcode ID: 47d589e7002637ad271a30cb3b833af3de7fc1feb1c344688effc0efc51bab2a
                      • Instruction ID: b5b43ef87fca550ccf51365e88df5427313b2c18efa9e611dd1bfa748613b494
                      • Opcode Fuzzy Hash: 47d589e7002637ad271a30cb3b833af3de7fc1feb1c344688effc0efc51bab2a
                      • Instruction Fuzzy Hash: E1115E3530469082EA219B13A5447EEA761F789BC4F544415FF8417BA6CF3ED4858B81
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: InflateRect
                      • String ID: iii
                      • API String ID: 2073123975-940974255
                      • Opcode ID: 69e2fbceedbdefc726a71d4b685647f81a83be0ce8473e5eae13d9c2e53dbddd
                      • Instruction ID: 16c1fe7495fc4071c9708b119cff16cbb90ccb0d34aac02819ab19261da9e8c3
                      • Opcode Fuzzy Hash: 69e2fbceedbdefc726a71d4b685647f81a83be0ce8473e5eae13d9c2e53dbddd
                      • Instruction Fuzzy Hash: 6A11183136065086E7269B2BAB4CF98B721E74AFF4F008310AE1517FF5CBBC99428B40
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: _errno_invalid_parameter_noinfo
                      • String ID: B
                      • API String ID: 2959964966-1255198513
                      • Opcode ID: 5ee74ecee0c85cfc562377a45ab9270d097f475a80928ad70fdd4bf629d26977
                      • Instruction ID: fb3500b40b852f48f0804901936c24314aa7a72bf73ee0480f3e810eb2782f8c
                      • Opcode Fuzzy Hash: 5ee74ecee0c85cfc562377a45ab9270d097f475a80928ad70fdd4bf629d26977
                      • Instruction Fuzzy Hash: 46118B72624A5086EB11DF12E4413DAB6A1F798FE8F584320AF680BBA5DF39C140CA00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: EmptyRect
                      • String ID:
                      • API String ID: 2270935405-3916222277
                      • Opcode ID: 0dbf5ffb0a476053056d58d485493f77be2fb5fadf171f8168b9a4b3c10e185d
                      • Instruction ID: f3be50a078f7ed53aeea1469e1a2339a8aa2315aba04f1b75b7f629806412791
                      • Opcode Fuzzy Hash: 0dbf5ffb0a476053056d58d485493f77be2fb5fadf171f8168b9a4b3c10e185d
                      • Instruction Fuzzy Hash: C8216A3A110BC589D7719F22BD887CA37A8F348B4CF544219DE991BB29CF35D2A9E704
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: ActivateAddressProc
                      • String ID: SHCreateItemFromParsingName$Shell32.dll
                      • API String ID: 557703559-214508289
                      • Opcode ID: bfbd695a7d2dc2981de186b415aa0603c33800aa99841ef43f63d490a7a9a05c
                      • Instruction ID: b425089b0913de602d021447131537bc00d14d89ef3db6b65e3cc31c7eb7a23d
                      • Opcode Fuzzy Hash: bfbd695a7d2dc2981de186b415aa0603c33800aa99841ef43f63d490a7a9a05c
                      • Instruction Fuzzy Hash: 04017131A0478081EA12CB17B8847DA63A4B79DBE4F544625EF6A5BBF4DF39C5418740
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: CopyInfoMonitorRect
                      • String ID: (
                      • API String ID: 2119610155-3887548279
                      • Opcode ID: 029c27c7e513445eed0adac94b604619e5c50e873f80d25da9d86fba1a5c35c8
                      • Instruction ID: bd8afc6862c5834f01f4aebfcc438d9c85e1ccbc7d723e21edb15653615bee46
                      • Opcode Fuzzy Hash: 029c27c7e513445eed0adac94b604619e5c50e873f80d25da9d86fba1a5c35c8
                      • Instruction Fuzzy Hash: 8211CE72604684CBD760DF35E484749B7E0FB8CB59F448025EA498B628DB38D984CF10
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: InflateRect
                      • String ID: iii
                      • API String ID: 2073123975-940974255
                      • Opcode ID: 2f8c4151ac21f4292d0dd1577f05b9012d8246df6b7596e37b4c93be2892bf07
                      • Instruction ID: 219a6b7fa8ee2ad49d2264cec3d63c9fcae4b1e234ed401648fe45beca048a1d
                      • Opcode Fuzzy Hash: 2f8c4151ac21f4292d0dd1577f05b9012d8246df6b7596e37b4c93be2892bf07
                      • Instruction Fuzzy Hash: 9CF04F3535065086EB269B27AF4CF98A622D75EFF4F0492115E1607FF6CE3C89404B00
                      Uniqueness

                      Uniqueness Score: -1.00%

                      APIs
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.687065278.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true
                      • Associated: 00000000.00000002.687060971.0000000140000000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687245592.000000014017B000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687311300.0000000140204000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687427501.00000001402ED000.00000004.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687432936.00000001402F0000.00000002.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687447370.0000000140304000.00000010.00020000.sdmp Download File
                      • Associated: 00000000.00000002.687452058.0000000140305000.00000002.00020000.sdmp Download File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_140000000_#U5e74#U7ec8#U63d0#U6210#U5206#U7ea2#U6838#U5bf9#U8868@i4.jbxd
                      Similarity
                      • API ID: InflateRect
                      • String ID: iii$
                      • API String ID: 2073123975-462628325
                      • Opcode ID: 4e2ef95258d7d0c302a41dfe226fb78c9898578340c9aa83e7553c8051c9694f
                      • Instruction ID: 9212dd924c7ce1b9418d020b96f8f5940149e14e6cbff3288163add10698ecf8
                      • Opcode Fuzzy Hash: 4e2ef95258d7d0c302a41dfe226fb78c9898578340c9aa83e7553c8051c9694f
                      • Instruction Fuzzy Hash: 75E06D3435064086E6268B33AE8CF94F622EB5DFF4F149225AE1107BF4CA7CD9404B40
                      Uniqueness

                      Uniqueness Score: -1.00%